I want to validate the Wordpress Rest API for requests from two different domains.

Wordpress, Cookie or O-auth methods can be verified. But it is impossible to accept external requests with Cookie. What remains is to verify with O-auth. The bad thing is I can't use O-Auth in my project.

So I wrote myself a "en / de Crypt" function. The domain I request encrypts the information, and the other domain decodes and verifies this password.

After all, if the encrypted information is correct, I give the API authorization with a function like the following.

function checkApiAuth( $result ){

    $encryptAPIKey = $_GET['requestKey'];

    if( decryptFn( $encryptAPIKey ) === $realKey ):
        $result = true;

        $result = false;


    return $result;           
add_filter('rest_authentication_errors', 'checkApiAuth');

However, this method works the same as the requesting domain. If a request is received from a different domain, it does not work (I think Acces-Control-Allow-Origin-related) is an obstacle.

Although I did this as follows, I could not authorize the Rest API for requests from outside.

Access-Control-Allow-Origin: *

Any assistance will be appreciated. Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.