Wordpress JSON API restrict to specific domain

Question

I have installed and activated the Wordpress JSON API (http://wordpress.org/plugins/json-api) in my self hosted WP site. Now my site content is open to the world via this API in JSON format.

But, I want to restrict the access of this JSON API only to the requests that are coming from specific domain. Even though someone got to know that my site has JSON API enabled and the URL endpoint, they should see 'Access Denied' except the requests comes from a specific allowd domain.

How to implement this restriction in WP?

Thanks in advance.

Answer 1

More reliable will be allowing specific IP instead of domain using REMOTE_ADDR header. You can use HTTP_REFERRER header but it is not reliable.

You can do it via using rest_authentication_errors filter.

add_filter( 'rest_authentication_errors', 'wpse150207_filter_incoming_connections' );

function wpse150207_filter_incoming_connections( $errors ){

    $allowed_ips = array( '127.0.0.1' );
    $request_server = $_SERVER['REMOTE_ADDR'];

    if( ! in_array( $request_server, $allowed_ips ) )
        return new WP_Error( 'forbidden_access', 'Access denied', array( 'status' => 403 ) );

    return $errors; 

}

The rest api will generate 403 error on ips other that given ip array.

Note: The solution works for WP v4.4.2 + Rest API v2.0-beta12.

Answer 2

The software provided has tools to utilize the WordPress Nonce system. As now written, the nonce is only used there to validate the submissions of posts via an API call. The good news is that the code is well organized and it would be pretty easy to customize the code to require a nonce submission (or other security token system) for all API requests.

Note: A nonce is a "number used once" to protect URLs and forms from being misused. Ref: http://codex.wordpress.org/WordPress_Nonces Nonces are generated on the hosting site, then sent to a user, so they can include it in their API request to validate their authority. A nonce is only good for two verification checks, and if unused expires in 24 hours. There is a concern that anyone could 'ask' for a nonce, and perhaps you would have to revert to a password/id system.

== Method: get_nonce ==
Returns a WordPress nonce value, required to call some data manipulation methods.
= Required arguments =
* `controller` - the JSON API controller for the method you will use the nonce for
* `method` - the method you wish to call (currently `create_post` is the only method that requires a nonce)
= Response =
    {
      "status": "ok",
      "controller": "posts",
      "method": "create_post",
      "nonce": "cefe01efd4"
    }  

== Method: create_post ==
Creates a new post.
= Required argument =
* `nonce` - available from the `get_nonce` method (call with vars `controller=posts` and `method=create_post`)
= Optional arguments =
* `status` - sets the post status ("draft" or "publish"), default is "draft"
* `title` - the post title
* `content` - the post content (etc...)

In order for a client application to obtain data via the API (e.g. get the 'About' Page) I would expect re-written code to function in this manner:

<?php
require_once 'HTTP/Client.php';
$http = new HTTP_Client();
$http->get('http://wordpress.test/?json=core.get_page&slug=about&dev=1&nonce=cefe01efd4');
$response = $http->currentResponse();
$response = json_decode($response['body']);

echo "Response status: $response->status\n";
echo "Page title: {$response->page->title}\n";
?>
--EXPECT--
Response status: ok
Page title: About Us -- This is an awesome website.

Answer 3

For those reading this post in 2021, adding to the fine answer of @Sisir

WordPress: version 5.7.2
PHP: version 7.4

Did you try the Permission Callback ?

According to the following 2 nice sources from the WP REST API Handbook:
REST API Handbook / Extending the REST API / Routes and Endpoints
REST API Handbook / Extending the REST API / Adding Custom Endpoints

/**
 * Permission Callback function:
 * 'ypp' is the Prefix I chose (ypp = Your Private Page)
 */

function ypp_get_private_data_permissions_check() {
    /**
     * Restrict endpoint to allowed IPs (white listing approach)
     */
    $allowed_ips = array( '127.0.0.1' );
    $request_server = $_SERVER['REMOTE_ADDR'];

    if( ! in_array( $request_server, $allowed_ips ) )
        return new WP_Error( 'rest_forbidden', esc_html__( 'Access denied from your IP address.', 'my-text-domain' ), array( 'status' => 401 ) );

    return true;
};

add_action('rest_api_init', function() {
    /**
    * Register here your custom routes for your CRUD functions
    */
    register_rest_route( 'your_private_page/v1', '/data', array(
        array(
            'methods'  => WP_REST_Server::READABLE,
            'callback' => 'get_your_data', // <-- your main callback function
            // Always allow GET, for example
            'permission_callback' => '__return_true' // <-- to leave it open
            ),
        array(
            'methods'  => WP_REST_Server::CREATABLE,
            'callback' => 'insert_your_data', // <-- your main callback function
            // Here we register our permissions callback. The callback is fired before the main callback to check if the current user can access the endpoint.
            'permission_callback' => 'ypp_get_private_data_permissions_check',
        ),
        array(
            'methods'  => WP_REST_Server::EDITABLE,
            'callback' => 'update_your_data', // <-- your main callback function
            // Here we register our permissions callback. The callback is fired before the main callback to check if the current user can access the endpoint.
            'permission_callback' => 'ypp_get_private_data_permissions_check',
        ),
    ));
});

Note:
No Plugin needed anymore. The WP REST API has been merged into WordPress core.