0

after a lot of search on the internet I found that to connect an android application with a wordpress website I have to use JSON API. In my website users are able to register or login to their unique account(Like it is on facebook, gmail, tweeter etc.). The problem I am facing is that I cannot understand how to link the data between the website and the android app so as the users will be able to use both of them with the same account. The problem is that in my JSON API user passwords are stored in hashed form, something like that:

{
"1": {
        "ID": 1,
        "user_login": "user1",
        "user_pass": "$P$BT6.fyjiaKZVEx/jM8sy5kC4QRkizg.",
        "user_nicename": "user-1",
        "user_email": "user1@gmail.com",
        "user_url": "http://localhost/MyWebsite",
        "user_registered": "2021-10-27 21:29:02",
        "user_activation_key": "",
        "user_status": 0,
        "display_name": "User 1"
    },
    "2": {
        "ID": 2,
        "user_login": "user2",
        "user_pass": "$P$BArUGOBZAJfD1J3sE8OgRA3Bk1Ynfg/",
        "user_nicename": "user-2",
        "user_email": "user2@gmail.com",
        "user_url": "",
        "user_registered": "2021-10-31 18:31:32",
        "user_activation_key": "",
        "user_status": 0,
        "display_name": "User 2"
    }
}

So, is there a way to connect those data with the application?

1
  • 1
    You mean you don't know how to login to the site using the REST API and as a result don't know the ID of the user inside the app? I do hope you're not using an application password to expose every users password hash and email to anybody who has the android app, that's an extreme security breach, anybody who taps your apps communication could make devastating attacks to your site ( easily done with common tools such as charlesproxy )
    – Tom J Nowell
    Nov 29, 2021 at 0:10

1 Answer 1

1

Out of the box there is no mechanism for a user to login via the REST API to begin a session without pre-configured access. WordPress Core provides 2 authentication methods for the REST API:

  • cookies + nonces
  • application passwords

Likewise there is no mechanism for registering for an account via the REST API, user creation requires authenticated requests from a user with admin access. Note that making such requests carries risk, you do not want those kinds of credentials being used in your application as it would make your site extremely easy to hack.

You might be able to do this via 3rd party authentication plugins however.

https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/#authentication-plugins

There are also plugins that try to fill this gap, though I cannot recommend them here as recommendations are off topic here, and any recommendation would be quickly out of date.

The problem is that in my JSON API user passwords are stored in hashed form, something like that:

Exposing hashed passwords is dangerous, exposing plaintext passwords is even more dangerous. Both would be considered a data breach. Storing plaintext passwords would be seen as gross negligence and would make your app fail many forms of compliance. It could be illegal to offer your application in some countries if plaintext passwords were used.

The user_pass is of no use to you here, and its presence in your example implies that you've given your application an alarming level of access to your site.

1
  • I see what you mean. I tried to use a 3rd party plugin and is more clear now what I need. However, I will create a new question because I found something that may be easier to explain what I exactly need. Thanks for your time and help! Nov 29, 2021 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.