I am envisioning Wordpress on the back end to work with React.js on the front end like this:
- Wordpress is installed on
- React.js script is loaded into
http://example.com/index.html, through script tags and then injected into a root div
There is a problem though. Without wordpress controlling registration and enqueuing, I do not see how to localize a nonce into the React.js script file.
Without the nonce the routes would not be authenticatable as cookie verification requires it in the
X-WP-Nonce header. https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
An API request could be made for a nonce, but the route would necessarily be unprotected, making it highly insecure.
What is the solution to this? How are you guys setting up headless wordpress to pass authentication information, such as a nonce, to your front end script files?