0

I developing mobile apps, that connect directly to woocommerce rest api. I use this plugin for authenticating, like registering, login, make an order, etc.

So the issue come, when I register new user (with default role is Customer), I try to make an order : http://123.456.789.910/lili_shop/wp-json/wc/v3/orders , it says :

{
    "code": "woocommerce_rest_cannot_view",
    "message": "Sorry, you cannot list resources.",
    "data": {
        "status": 403
    }
}

Then I change user role of registered user to "Administrator", it works.

But, what I want is, a new registered user (with default role is Customer) can consume woocommerce API with JWT too, how can I achieve this?

Anyhelp will appreciate.

Thanks.

| improve this question | | | | |
  • Why would a customer be allowed to view all Orders on a site? – Jacob Peattie Feb 22 '19 at 6:47
  • Create also cant. woocommerce_rest_cannot_create , how? @JacobPeattie – Nasihun Amin Suhardiyan Feb 22 '19 at 7:57
  • Customers don’t create orders either. Otherwise they could creat arbitrary orders without paying. The system creates orders. Your application should probably be using an API key for those types of operations. – Jacob Peattie Feb 22 '19 at 8:31
  • So with woocommerce REST API, what should I do if customer want to place an order ? @JacobPeattie – Nasihun Amin Suhardiyan Feb 22 '19 at 10:16
  • I told you: Make the request from your application using an API key that has permission to do that. – Jacob Peattie Feb 22 '19 at 10:20
1

Not sure if you are still looking for a solution but I ran into a similar issue where I was not able to even retrieve the product listing from a customer account. There were a few things I realized when doing it:

  1. Since administrator had access it had to be a security issue.
  2. I installed a user role editor and added some of the extra privileges to see if it would work. (I was testing just the product listing and categories at the time). Note: You can only use read access for the roles in particular if security is an issue.
  3. This worked and I was able to retrieve the listing for the products and the categories.

I am still looking for a solution to the orders but it definitely involves doing something with security (will edit this post if I do find one). My instinct tells me that JWT Token used in woocommerce checks if the user even have access to edit the information.

It is definitely not an issue with the JWT token but something on woocmmerce side. See this post for details: https://github.com/woocommerce/woocommerce/issues/17983 Hope this helps.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.