2

I'm trying to post to a WordPress server on an AWS Lightsail instance using node-wpapi. However, the server returns a 401 error.

I already have a .htaccess file with RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}] to my .htaccess file and I already use 'application passwords' plugin.

How can I use node-wpapi to access the server?

My node-wpapi setting is here.

const wp = new WPAPI({
    endpoint: 'http://localhost/wp-json',
    username: 'user', //This is a default admin user.
    password: '*************************', //This is a password for application passwords plugin 
    auth: true,
});

My .htaccess file is here.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

The error message is here.

 code: 'rest_cannot_create',
  message: 'Sorry, you are not allowed to create new posts.',
  data: { status: 401 }

My user profile page keeps displaying the following message.

> Due to a potential server misconfiguration, it seems that HTTP Basic Authorization may not work for the REST API on this site: `Authorization` headers are not being sent to WordPress by the webserver. You can learn more about this problem, and a possible solution, on our GitHub Wiki.

1

I've found a solution.

The WordPress made from AWS Lightsail instance image is bitnami WordPress. And the bitnami WordPress is disabled Basic Authentication as default. So it needs some modification on /opt/bitnami/apps/WordPress/conf/httpd-app.conf to enable Basic Authentication. This modification is adding 3 lines below.

RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

The httpd-app.conf ended up below.

RewriteEngine On
RewriteRule /<none> / [L,R]

<IfDefine USE_PHP_FPM>
    <Proxy "unix:/opt/bitnami/php/var/run/wordpress.sock|fcgi://wordpress-fpm" timeout=300>
    </Proxy>
</IfDefine>

<Directory "/opt/bitnami/apps/wordpress/htdocs">
    Options +MultiViews +FollowSymLinks
    AllowOverride None
    <IfVersion < 2.3 >
        Order allow,deny
        Allow from all
    </IfVersion>
    <IfVersion >= 2.3>
        Require all granted
    </IfVersion>
    
    

    <IfDefine USE_PHP_FPM>
       <FilesMatch \.php$>
         SetHandler "proxy:fcgi://wordpress-fpm"
       </FilesMatch>
    </IfDefine>

RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
    
    RewriteEngine On
    #RewriteBase /wordpress/
    RewriteRule ^index\.php$ - [S=1]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . index.php [L]

    Include "/opt/bitnami/apps/wordpress/conf/banner.conf"
</Directory>

Include "/opt/bitnami/apps/wordpress/conf/htaccess.conf"
                    

Then restart apache or the instance itself. Then I installed the Application Passwords plugin and I use it as a normal procedure.
The following message of the plugin displayed on the profile page has gone.

 Due to a potential server misconfiguration, it seems that HTTP Basic Authorization may not work for the REST API on this site: `Authorization` headers are not being sent to WordPress by the webserver. You can learn more about this problem, and a possible solution, on our GitHub Wiki.

The HTTP_AUTHORIZATION environment variable in the .htaccess file doesn't need to be replaced REMOTE_USER. Just in case, I show my .htaccess file below.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

This solution is from this page.
The difference of solution between this solution page and my solution above is I use the Application Passwords plugin but they use the JSON Basic authentication plugin.

2
  • From the look of the server config you've posted, .htaccess files are completely disabled (AllowOverride None) - so anything you added to .htaccess is not doing anything. (?) The directives you have in the server config (ie. the WordPress front-controller) make the .htaccess directives redundant anyway. Incidentally, RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] is the same as the directives you've ended up using, namely: RewriteCond %{HTTP:Authorization} ^(.*) / RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
    – MrWhite
    Jul 8 at 12:26
  • "the bitnami WordPress is disabled Basic Authentication as default" - It's not "Basic Authentication" that is disabled. By default, Apache prevents the Authorization header being passed to backend scripts as a "security" measure. If you just required Apache to manage the HTTP Basic Authentication then it would work just fine.
    – MrWhite
    Jul 8 at 12:29
0
RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]

Unless you have specific requirements, you would ordinarily set the HTTP_AUTHORIZATION environment variable here, not REMOTE_USER, in order to essentially pass the Authorization HTTP request header as-is through to PHP/WordPress. (Which would seem to be what the error is suggesting?)

UPDATE: Also try setting CGIPassAuth On at the top of the .htaccess file. See my answer on the following related question on StackOverflow.

4
  • Thank you for your reply. I tried to replace REMOTE_USER with HTTP_AUTHORIZATION, but it didn't work. The reason why I use REMOTE_USER is that I followed the instruction on this page. Do you have any other ideas?
    – Pierogi
    Jul 7 at 12:04
  • @Pierogi Also try adding the CGIPassAuth On directive. I've updated my answer.
    – MrWhite
    Jul 7 at 18:53
  • @Pierogi Not sure why they are suggesting to use REMOTE_USER with that plugin (unless this is something unique to that plugin, but it seems odd)? REMOTE_USER and the value of the Authorization header are two very different things. Normally, REMOTE_USER contains just the unhashed username (eg. user), whereas the Authorization header contains the authorization type and hashed username/password (eg. Basic Z3Vlc3Q6YXNk). This also contradicts the standard WordPress .htaccess config.
    – MrWhite
    Jul 7 at 18:54
  • Thank you MrWhite! I've found a solution. It didn't need to replace HTTP_AUTHORIZATION with REMOTE_USER as you mentioned. The problem was the httpd-app.conf file. Please see my solution for details.
    – Pierogi
    Jul 8 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.