I have webapp A (running wordpress) talking to webapp B (running on Java, no wordpress or php).

B issues xmlrpc requests to A over https.

In order to secure the xmlrpc endpoint on A I'd like to verify the identity of the caller i.e making sure A only accepts xmlrpc requests generated by B.

In Java this is doable by grabbing the HttpServletRequest object and checking for the remote host. Not so sure how to do this with php/wordpress. Any pointers appreciated...

  • this is a basic php question not specific to wordpress Jul 2 '16 at 13:56

I guess there is $_SERVER['HTTP_ORIGIN'] property which can be helpful for this point, or even HTTP_REFERER, hooking into the init hook to make sure nothing runs until this origin is allowed, something like:

add_action("init", function() {
    global $pagenow;
    if ( "xmlrpc.php" !== $pagenow ) return; // xmlrpc.php only
    $domains = array( "example.com" ); // domains to allow
    if( !isset($_SERVER['HTTP_ORIGIN']) || !in_array($_SERVER['HTTP_ORIGIN'], $domains) ) {
        exit('No requests allowed from this origin.');
    } return;
}, 0);

I have hooked into init and used global $pagenow because I did not find any other hook to be listened to initially in that file.

Hope that helps with your practice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.