node-wpapi: how to handle authentication?

Question

I'm referring to official node-wpapi javascript client library for official (4.7+) REST APIs. Here the doc: http://wp-api.org/node-wpapi/authentication/#cookie-authentication

I'm reading the Cookie Authentication paragraph, but I'm not in this situation.

I'm trying to build a Single Page App, so I need to register/login/logout the user using REST API. I don't need to use node-wpapi, I could use any other library to call the API endpoints.

But my problem is I'm not able to understand what must I call to log an user in and what must I save to handle the other api calls where user need to be logged in (to create a post, for example).

Answer 1

I'm the author of the node-wpapi library, thanks for checking it out. Unfortunately we do not currently support any external authentication scheme out of the box, because WordPress itself does not ship with any authentication scheme other than the cookie/nonce option (which doesn't work with external apps, as you describe).

There are plugins for authenticating API requests using JWT and OAuth 1.0a, and handling for those methods could be executed for node-wpapi using a combination of custom transport methods and the new .setHeaders() function that we introduced in last week's 1.1 release of node-api.

However, what you are describing does not quite sound like something that would be solved by those approaches. Specifically, REST API authentication is a way to authenticate a single request against your WordPress site -- to say, in effect, "I have the right to view or edit the resource I am requesting." The REST API does not provide a mechanism to log in to WordPress, that should be handled using the existing WordPress login form.

If your SPA is designed to run in a plugin, I recommend setting it up to make a page that can only be viewed on login -- then when your users try to open the app they will be directed to WordPress's existing login page, then back to your app. Once logged in, a single page application can then use cookie/nonce authentication for API requests. For an example, see the project at https://github.com/kadamwhite/wp-notebook

Hope this helps, and thanks for using the REST API!