0

When I use a REST route whilst logged in, and call wp_get_current_user(), no user is found. However, the request method, eg POST is processed without issue. Example REST route registration.

register_rest_route(
    'dewd-test-namespace', //namespace
    'dewd-test-namespace-test-route', //route
    [
     'methods'=>'POST',
     'callback'=>[
          $this,   //object of this class
          'testingUser' //function
      ] 
    ] //params
);

Call to wp_get_current_user() returns this user object:

WP_User Object
(
    [data] => stdClass Object
        (
        )

    [ID] => 0
    [caps] => Array
        (
        )

    [cap_key] => 
    [roles] => Array
        (
        )

    [allcaps] => Array
        (
        )

    [filter] => 
    [site_id:WP_User:private] => 0
)

i.e no user. If a permission callback is added e.g. `

'permission_callback' => function () {

     return current_user_can( 'edit_others_posts' );
 }

A 401 status is returned with the message "Sorry, you are not allowed to do that".

I would appreciate it if anyone knows what I might need to do in order for wp_get_current_user() to return the current user in a REST call.

3
  • Since the wp_get_current_user() is not returning anything and you get a 401 when adding the permission callback, my guess would be that you are not logged in when trying to POST data to your endpoint. If you return the value from is_user_logged_in() in your endpoint I guess you would get a false value. It also seems like you really should use GET here since you are trying to retrieve data, not create anything. You could also try some of the answers in this question: stackoverflow.com/questions/38371754/… – Cyclonecode Sep 19 '20 at 21:46
  • 1
    Here I think is the solution to your problem, you probably forgot about the authentication and nonces: stackoverflow.com/a/42469456/1047662 Here is another link also related to this: wordpress.stackexchange.com/questions/295471/… – Cyclonecode Sep 19 '20 at 21:54
  • 1
    @Cyclonecode you're right. Looks like I need to use a solution similar to this: stackoverflow.com/a/57032303/2298108. Btw, definitely logged in and I'm actually going to be creating/ updating data so POST is correct. I'm just using this basic example t show I couldn't get the user id via REST for something else I need. Thx bud. – dewd Sep 19 '20 at 23:38
1

This is happening because you are not using nonces. Because you have not provided a nonce with the request, Wordpress is treating you as if you are an unauthorized/non-logged in user. This is because wordpress has no way of knowing/validating the users state.

To get this working, you will have to generate a nonce like so:

wp_create_nonce( 'wp_rest' )

and provide it to the app that is making the rest call. Once your app has the nonce value, you would add it to the rest request like so:

headers: {
    'X-WP-Nonce': nonce,
}

Once you've done this, Wordpress will be able to use the nonce to properly validate the user and conditional checks for permissions will work as expected.

Edit

Per your comment, I thought I would elaborate as this information may be useful for anyone coming across this in the future.

A nonce is defined as a number used once. How wordpress uses them, and why it's required is the following:

"A nonce is a "number used once" to help protect URLs and forms from certain types of misuse, malicious or otherwise. WordPress nonces aren't numbers, but are a hash made up of numbers and letters. Nor are they used only once, but have a limited "lifetime" after which they expire. During that time period the same nonce will be generated for a given user in a given context. The nonce for that action will remain the same for that user until that nonce life cycle has completed.

WordPress's security tokens are called "nonces" despite the above noted differences from true nonces, because they serve much the same purpose as nonces do. They help protect against several types of attacks including CSRF, but do not protect against replay attacks because they aren't checked for one-time use. Nonces should never be relied on for authentication or authorization, access control. Protect your functions using current_user_can(), always assume Nonces can be compromised.

For an example of why a nonce is used, an admin screen might generate a URL like this that trashes post number 123."

The TLDR is that nonces are used in conjunction with user authentication cookies provided in the rest request, just like with any server side request. Nonces just provide an additional layer that can be relied on to ensure the user is who they say they are. It's not a replacement for authentication per se.

For a comprehensive description, see https://codex.wordpress.org/WordPress_Nonces#:~:text=WordPress%20nonces%20aren't%20numbers,user%20in%20a%20given%20context.

1
  • You are correct, but it's strange that it needs this. WordPress sends a ton of cookie information over and there's no reasosn why it couldn't hash whatever it needs to here. One of the cookies is actually something like wp_user_logged_in(). This nonce stuff is completely superfluous from a security perspective. In any case, I'll test this and accept your answer if/ when it works. – dewd Sep 20 '20 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.