Timeline for Wordpress JSON API restrict to specific domain
Current License: CC BY-SA 3.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 7, 2021 at 15:23 | answer | added | Jürgen Fink | timeline score: 0 | |
| Jan 30, 2017 at 21:20 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Dec 25, 2016 at 22:48 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Nov 15, 2016 at 12:40 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Oct 11, 2016 at 5:43 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 6, 2016 at 14:35 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jul 31, 2016 at 6:11 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jun 30, 2016 at 21:18 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| May 23, 2016 at 8:37 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Feb 11, 2016 at 12:27 | answer | added | Sisir | timeline score: 2 | |
| Jun 20, 2014 at 10:58 | answer | added | zipzit | timeline score: 0 | |
| Jun 20, 2014 at 10:21 | comment | added | zipzit | (hint... I'm learning too... I'm only 15 minutes more experienced then you :') This isn't a total cake walk. How do you know who is who when you give the nonce out the first time? You may have to poll ID/password. One thing that is cool is the nonce system is pluggable, so you can unplug standard WordPress nonce and insert your own custom one, one that might last for a different period of time but might be usable five times or whatever. | |
| Jun 20, 2014 at 10:10 | comment | added | user1655746 | Yup, thats exactly I was looking for. Thanks for explaining nonce usage (am a newbie) ;) | |
| Jun 20, 2014 at 9:55 | comment | added | zipzit |
Yup, and a smart developer can scrape the data from your public web site anyway. Sorry, but nonce is the tool provided in that package shown above. A nonce is a "number used once" to protect URLs and forms from being misused. (Exactly what you are asking for...so.. what's the issue?) Look at http://codex.wordpress.org/WordPress_Nonces Remember the nonce will have to be generated at your site, sent to a user and they include it in their API request to validate their authority. A nonce is only good for two verification checks, and if unused expires in 24 hours. Its the right tool for you.
|
|
| Jun 20, 2014 at 9:20 | comment | added | user1655746 | Yes, my site content is public, but if I let the JSON also open, any developer who knows the base JSON API URL can use it to create a client (Android / iOS app) which I want to avoid. Yes, creating nonce in one way is good, but that is also available for the devs to create one from the JSON API interface. | |
| Jun 20, 2014 at 9:08 | comment | added | zipzit | Another related question. I'm assuming you have a public website with posts, pages & other content. The only content available via API call is generally the same content visible on your website. With those assumptions it would seem odd to restrict content via an API call that would be available via a simple look at your website. | |
| Jun 20, 2014 at 9:05 | comment | added | zipzit |
Not to worry. There are ways to verify the person asking for data from the server is authorized, generally with a piece of code within the header. Hang On, I'm checking the code. I love this line in there // oh please oh please oh please oh please oh please I'm going thru the code, and I don't see a lot of security checking except for the use of the wordpress nonce system. As written now, that code only requires nonce's for creating a new post and submitting it via API call. It would be easy to require that for data requests.
|
|
| Jun 20, 2014 at 7:18 | review | First posts | |||
| Jun 20, 2014 at 7:26 | |||||
| Jun 20, 2014 at 6:58 | history | asked | user1655746 | CC BY-SA 3.0 |