4

The idea is to show or hide some sections of the site in a theme that's fetching all data from the REST API, using AngularJS.

I thought this check would help me (nonce is passed as header, as suggested by docs):

wp_localize_script('angularjs', 'params', array(
    'nonce' => wp_create_nonce('wp_rest'),
    'nonce_verify' => wp_verify_nonce($_REQUEST['X-WP-Nonce'], 'wp_rest')
));

The nonce parameter works and i can pass it as request header through AngularJS, successfully logging. But the nonce_verify didn't as expected.

So the question: is there a way to check if an user is logged in when using cookie authentication? Thank you.

EDIT: I localized nonce's value cause i needed to get it in this piece of angularJS code. That's where auth happens:

$httpProvider.interceptors.push(function () {
            return {
                'request' : function (config) {
                    config.headers = config.headers || {};

                    config.headers['X-WP-Nonce'] = params.nonce;

                    return config;
                }
            }
        });
4
  • Are you trying to get an HTTP header with this $_REQUEST['X-WP-Nonce'] ?
    – ClemC
    Aug 24, 2017 at 16:31
  • @ClemC Sorry, my bad. I used $_SERVER Aug 24, 2017 at 16:32
  • 1
    Why don't you simply use is_user_logged_in()?
    – Johansson
    Aug 24, 2017 at 16:57
  • 1
    @JackJohansson Using is_user_logged_in works, but i wondered if i could rely on the rest api in full. Aug 24, 2017 at 17:09

1 Answer 1

4

You shouldn't pass your nonce to your JavaScript to verify it, since client side scripts can be easily manipulated. Instead, you should get the nonce from your front-end content, and then pass it to server to verify it.

After verification, you should decide to output content by server, not by your JavaScript file.

Something like this:

if ( is_user_logged_in() ) {
    if ( wp_verify_nonce($_REQUEST['X-WP-Nonce'], 'wp_rest') {
        // Nonce is correct!
    } else {
        // Don't send the data, it's a trap!
    }
}

As a side note, REST API offers its own method to fetch the passed queries. So, you can get it this way in your callback function:

function foobar( \WP_REST_Request $request ) {
    $nonce = $request['X-WP-Nonce'];
}
10
  • That's what i thought to do, i'm not exposing my nonce's value Aug 24, 2017 at 17:13
  • 1
    You are localizing the script and passing both nonce and verification to the script, which can be accessed by using params.nonce!
    – Johansson
    Aug 24, 2017 at 17:14
  • Now i got your point... Aug 24, 2017 at 17:16
  • I can simply write a custom script in the browser's scratch pad and extract that data. Once it's passed to the browser, it's over.
    – Johansson
    Aug 24, 2017 at 17:16
  • 1
    I mean that you can't get a HTTP header named 'X-WP-Nonce' with $_REQUEST['X-WP-Nonce']... Instead $_SERVER['HTTP_X_WP_NONCE'] may return it.
    – ClemC
    Aug 24, 2017 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.