Checking for origin of a xmlrpc request

Question

I have webapp A (running wordpress) talking to webapp B (running on Java, no wordpress or php).

B issues xmlrpc requests to A over https.

In order to secure the xmlrpc endpoint on A I'd like to verify the identity of the caller i.e making sure A only accepts xmlrpc requests generated by B.

In Java this is doable by grabbing the HttpServletRequest object and checking for the remote host. Not so sure how to do this with php/wordpress. Any pointers appreciated...

Answer 1

I guess there is $_SERVER['HTTP_ORIGIN'] property which can be helpful for this point, or even HTTP_REFERER, hooking into the init hook to make sure nothing runs until this origin is allowed, something like:

add_action("init", function() {
    global $pagenow;
    if ( "xmlrpc.php" !== $pagenow ) return; // xmlrpc.php only
    $domains = array( "example.com" ); // domains to allow
    if( !isset($_SERVER['HTTP_ORIGIN']) || !in_array($_SERVER['HTTP_ORIGIN'], $domains) ) {
        exit('No requests allowed from this origin.');
    } return;
}, 0);

I have hooked into init and used global $pagenow because I did not find any other hook to be listened to initially in that file.

Hope that helps with your practice.