Charlie Merland

If your app is also using the default cookie auth method, but using a custom nonce action, your auth callback must also verify the cookie and that the user is logged in just like rest_cookie_check_errors() does. Failure to do so introduces a security vulnerability. (I’m looking at you, Charlie)

Absolutely. That was implied by my “perform your own checks”, but I reckon it could have been more explicit.

Hi @ivrrimum,

Bumped into the same issue today, turns out it’s not an issue at all but a misunderstanding of how that part actually works.

Basically what’s not working is that you’re replacing the default REST API nonce with your own, making the check fail because WordPress has no knowledge of you new nonce action and therefore can’t verify it properly; If you change your ‘import_posts’ action to ‘wp_rest’, the default nonce action, it works as expected. If you want to use your custom action you have to hook to the rest_authentication_errors filter and perform your own checks:

add_filter( 'rest_authentication_errors', function( $result ) {

	// $result should be null. Any other value indicates something
	// happened before we got here.
	if ( ! is_null( $result ) || is_wp_error( $result ) ) {
		return $result;
	}

	// Make sure we need to authenticate at all.
	if ( empty( $_REQUEST['wtfaid'] ) || empty( $_REQUEST['_nonce'] ) ) {
		return $result;
	}

	// Verifiy the nonce.
	$nonce = $_REQUEST['_nonce'];
	if ( wp_verify_nonce( $nonce, 'import_posts' ) ) {
		return true;
	}

	// If we're still here, just return the original result.
	return $result;
});

Note that I added a wtfaid parameter to the Ajax request data to trigger the nonce verification only when I want it and not on every single API request :

var url = "https://wp-latest.d3v.talyes.pro/?rest_route=/posts_bank/v1/import_posts/1";
$.ajax({
	url: url,
	method: "POST",
	beforeSend: function ( xhr ) {
		xhr.setRequestHeader( 'X-WP-Nonce', wpApiSettings.nonce );
	},
	data: {
		_nonce : wpApiSettings.nonce,
		wtfaid : 'hello'
	},
	success: (response) => {
		alert(1);
	}
});

Also note that this method could have some collateral damage because of the replacing of the default action nonce if some other plugins/themes/features rely on it. I don’t know in what context you’re using this, but have you considered using the Backbone client for the REST API? If you’re dealing with custom post types and stuff it’s a really useful way to make use of the REST API, including permission checks, post/meta/terms creation/update/delete in a few lines of JS.

Anyway, hope that helped you somehow!

• This reply was modified 9 years, 1 month ago by Charlie Merland.
• This reply was modified 9 years, 1 month ago by Charlie Merland.