I am writing a Wordpress plugin that will allow logged in users to manage a specific resources via WP admin interface. These resources should then be made available to an Android app, but only users that are authenticated against the WP database are supposed to have access to the custom resources exposed by WP.

The way I decided to implement this is by adding an Ajax functionality into my plugin. To be precise, these are the two methods I've added:

add_action("wp_ajax_nopriv_login", "login");
add_action("wp_ajax_get_resources", "get_resources");

function login() {
    $login = $_POST["login"];
    $password = $_POST["password"];
    $authentication_result = wp_authenticate_username_password(null, $login, $password);

    if (is_wp_error($authentication_result)) {
    } else if (!in_array("administrator", $authentication_result->roles)) {
    } else {
        wp_signon(array("user_login" =>  $login, "user_password" => $password, "remember" => true));


function get_resources() {
    // do some work to get resources and then return them as JSON

My questions are as follows:

  1. Is there a better way to extend a WP instance with a custom API? This way of using wp_ajax actions seems really basic and limiting (e.g. all requests must be POST and in case of unauthenticated request, 200 status code is simply returned, which makes it hard to detect auth errors). I've experimented with a WP REST API plugin, but it brings in a lots of "default" API endpoints I don't want to clutter my WP with. Also, I stumbled over XML-RPC support in WP, but am a bit reluctant to use it - XML-RPC feels like something outdated and I don't want to make my plugin dependent on such technologies.
  2. The Android app will need to authenticate a user before he can access the resources via get_resources endpoint. In order to do that, the app will call the login endpoint with user-provided credentials. In case of successful login, it will store cookies returned by wp_signon method and use them with subsequent requests. Do you think this approach is secure?
  • 1
    this sounds like a question for the security stack, as you are not asking about wordpress security but how to design your own secure system. – Mark Kaplun Oct 11 '15 at 11:29
  • You are using unsanitized $_POST data. This is a problem by itself. Also you might want to look at the JSON/REST API plugin that will eventually be incorporated into core (search GitHub). – kaiser Oct 11 '15 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.