0

I'm developing an API for my Wordpress website, I want to authorize all API request using jwt token. already installed and configured this plugin "JWT Authentication for WP REST API".But when I try via get/post methode my API will return data with out passing jwt access token how can I prevent this?

function api_version()
{
    $api=array( "version"=> "v1",

    "time"=>date('Y-m-d H:i:s P'));
    return $api;
}

add_action( 'rest_api_init', function () {
  register_rest_route( 'v1/', 'info', array(
    'methods' => 'GET',
    'callback' => 'api_version',

  ) );
} );
0

The token just authenticates the request as coming from a specific user. You still need to use the permissions callback to check if that user has permission for whatever it is you're doing. If you omit the permissions_callback argument when registering the route then the route is public.

If you only need to check if there is a user, and not specific permissions, you could just use is_user_logged_in():

register_rest_route( 'v1/', 'info', array(
    'methods' => 'GET',
    'callback' => 'api_version',
    'permissions_callback' => function() {
        return is_user_logged_in();
    },
) );
  • hi my problem is fixed using "rest_pre_dispatch" hook . i check is_user_logged_in() in this hook – Reneesh Kurian Oct 24 at 13:36
  • That’s not the correct way to do this. To protect routes use the permissions callback. – Jacob Peattie Oct 24 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.