0

The idea is to show or hide some sections of the site in a theme that's fetching all data from the REST API, using AngularJS.

I thought this check would help me (nonce is passed as header, as suggested by docs):

wp_localize_script('angularjs', 'params', array(
    'nonce' => wp_create_nonce('wp_rest'),
    'nonce_verify' => wp_verify_nonce($_REQUEST['X-WP-Nonce'], 'wp_rest')
));

The nonce parameter works and i can pass it as request header through AngularJS, successfully logging. But the nonce_verify didn't as expected.

So the question: is there a way to check if an user is logged in when using cookie authentication? Thank you.

EDIT: I localized nonce's value cause i needed to get it in this piece of angularJS code. That's where auth happens:

$httpProvider.interceptors.push(function () {
            return {
                'request' : function (config) {
                    config.headers = config.headers || {};

                    config.headers['X-WP-Nonce'] = params.nonce;

                    return config;
                }
            }
        });
  • Are you trying to get an HTTP header with this $_REQUEST['X-WP-Nonce'] ? – ClemC Aug 24 '17 at 16:31
  • @ClemC Sorry, my bad. I used $_SERVER – Daniele Squalo Aug 24 '17 at 16:32
  • 1
    Why don't you simply use is_user_logged_in()? – Jack Johansson Aug 24 '17 at 16:57
  • 1
    @JackJohansson Using is_user_logged_in works, but i wondered if i could rely on the rest api in full. – Daniele Squalo Aug 24 '17 at 17:09
3

You shouldn't pass your nonce to your JavaScript to verify it, since client side scripts can be easily manipulated. Instead, you should get the nonce from your front-end content, and then pass it to server to verify it.

After verification, you should decide to output content by server, not by your JavaScript file.

Something like this:

if ( is_user_logged_in() ) {
    if ( wp_verify_nonce($_REQUEST['X-WP-Nonce'], 'wp_rest') {
        // Nonce is correct!
    } else {
        // Don't send the data, it's a trap!
    }
}

As a side note, REST API offers its own method to fetch the passed queries. So, you can get it this way in your callback function:

function foobar( \WP_REST_Request $request ) {
    $nonce = $request['X-WP-Nonce'];
}
  • That's what i thought to do, i'm not exposing my nonce's value – Daniele Squalo Aug 24 '17 at 17:13
  • 1
    You are localizing the script and passing both nonce and verification to the script, which can be accessed by using params.nonce! – Jack Johansson Aug 24 '17 at 17:14
  • Now i got your point... – Daniele Squalo Aug 24 '17 at 17:16
  • I can simply write a custom script in the browser's scratch pad and extract that data. Once it's passed to the browser, it's over. – Jack Johansson Aug 24 '17 at 17:16
  • 1
    I mean that you can't get a HTTP header named 'X-WP-Nonce' with $_REQUEST['X-WP-Nonce']... Instead $_SERVER['HTTP_X_WP_NONCE'] may return it. – ClemC Aug 24 '17 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.