The goal of nonces with forms is usually twofold: to ensure that the data is submitted only once, and that the user actually performs the submission. The second item that helps protect against fakes with cross-site requests: http://en.wikipedia.org/wiki/Cross-site_request_forgery
Working with them depends on the context. If the user fills out the form, and nonce fails, refresh the page (pre-fill in the data), say something benign, for example: "Unfortunately, there is a problem, please check your input and send again." A valid user can click send, the attack will be thwarted, or at least the user will know what is happening.
Validation may fail for several reasons. If you have some kind of browser cache enabled, the user visits one form (with this non-character), then goes to the other (with its own nonce) and returns to the first using the "Back" button. By providing the browser cache, they did not update page, and your server is likely to save only one valid nonce value for them in the session so that they do not match. Acceptable use case and unsuccessful nonce (not one, I would lose sleep, just make sure the form is re-filled).
By and large, my recommendation will be as follows: tell the user to submit again, subtly suggest that he should check their input, simplify sending.
source share