rest_authentication_errors
-
HI,
first of all, thank you for this plugin – It’s really great
I’ve played around with the new (beta) feature to allow rest authentication but it seems that it currently dont implement “rest_authentication_errors” in a correct way
add_filter('rest_authentication_errors', function ($result) { if (!empty($result)) { return $result; } if (!is_user_logged_in()) { return new WP_Error($_SERVER['REQUEST_URI'] . 'rest_not_logged_in', 'You are not currently logged in.', array('status' => 401)); } return $result; });In theory this code should work, so if I add a correct JWT Token in a API request it should flag me as logged in, but it returns the WP_Error
I’ve used before this plugin: https://github.com/jonathan-dejong/simple-jwt-authentication
and there it is working correctly
Another question: Is it possible to save the decryption_key into the wp-config.php (e.g. define(‘SIMPLE_JWT_LOGIN_SECRET_KEY’,’xxxxxx’)) and not in the database ?
Thank you 🙂
-
I’ve toggled this two lines in routes.php
); die(); } + return $endpoint; } - return $endpoint; }, 99 ); }This will force JWT Auth for any REST request – This dont answer my question, but it could be helpful for anyone else who wants to force a token for any rest endpoint 🙂
It could be helpful to add a switch for something like that – IMHO a lot of users only use the rest API for them self and dont want to provide them to public 🙂
BTW: Is there any Github repo to add pull requests ?
Hi @nicu_m ,
thank you for your answer 🙂 That’s exactly what I want, I’ve already modify the code locally to do this, that was also the reason why I’ve asked for a git pull request. So I could provide a working code for this (it also hides the key in the UI already and check if the bearer is defined globally (wp-config.php), if not it use the normal UI and saves to DB)
For the errors – A handling would be pretty great because in that case we could specify what permissions are needed on custom endpoints.
For the code I’ve provided above, it seems that it breaks Gutenberg (did not see this, I use classic editor)
Here is a fixed patch (for routes.php -> around line 51):
+ //Gutenberg compatibility + foreach ( $_COOKIE as $name => $value ) { + if ( 0 === strpos( $name, 'wordpress_logged_in_' ) ) { + return $endpoint; + } + } $jwt = $jwtService->getJwtFromRequestHeaderOrCookie(); if ( ! empty( $jwt ) ) { try { add_action( 'rest_api_init', function () { ); die(); } + return $endpoint; } - return $endpoint; }, 99 ); }Best regards and thank you for your work 🙂
The topic ‘rest_authentication_errors’ is closed to new replies.
