0

I have been trying to validate jwt token inside theme function.php file.

I am not sure how to pass this jwt token validate inside this hook function. The following function is working without authorization header also I need to protect the endpoint using jwt authorization without this it should throw a error. lot of example showing javascript based function to fetch the details.

add_action( 'rest_api_init', function ($data) {
    register_rest_route( 'jwt-auth/v1', 'sci', array(
       'methods' => 'POST', 
        'callback' => 'update_payment_history',
        'permission_callback' => '__return_true' 
    ) );  
    
  /*  register_rest_route( 'v1', 'certificates', array(
       'methods' => 'POST', 
        'callback' => 'update_payment_history',
        'permission_callback' => '__return_true' 
    ) ); */
    
    
    register_rest_route( 'jwt-auth', 'v1/token', array(
       'methods' => 'POST', 
        'callback' => 'gettoken',
        'permission_callback' => '__return_true' 
    ) );
    
    
  
    
    
    
} );

function update_payment_history(WP_REST_Request $request) {
print_r( $request->get_param('transaction_id'));
 exit;
}
4
  • 2
    there's already JWT authentication plugins, it would be much safer to use one of those rather than rolling your own security. Also JWT has questionable safety that requires going above and beyond to secure
    – Tom J Nowell
    Aug 16, 2022 at 15:02
  • are you asking how to check for JWT tokens in update_payment_history? If so, the answer is you do not, that's the function that handles the endpoint if the user has permission, JWT and authentication happens elsewhere. Have you checked the REST API handbooks section on authentication?
    – Tom J Nowell
    Aug 16, 2022 at 15:04
  • Yes how to check the jwt token is valid or not in update_payment_history function inside
    – mike
    Aug 17, 2022 at 9:17
  • 1
    you don't, that's not how you implement custom authentication in the REST API, have you looked at wordpress.org/plugins/jwt-authentication-for-wp-rest-api ? Or are you already using that plugin? If so you need to share that information. You are meant to authenticate before a callback is handled, not inside it. There is no information here on how you implemented JWT
    – Tom J Nowell
    Aug 17, 2022 at 11:48

1 Answer 1

1

Once user hit the api endpoint will check the token valid or not and process the function send information to wordpress api end point with success details.

 function update_payment_history(WP_REST_Request $request) {      
   if(!$request->get_header('authorization')){
 return new WP_Error(
            'jwt_auth_no_auth_header',
            'Authorization header not found.',
            array(
                'status' => 403,
            )
        );
        exit;
 } else if($request->get_header('authorization')){ 

  $response = wp_remote_post( 'https://example.com/wp-json/jwt- 
   auth/v1/token/validate', array(

'headers'     =>array(
                        'Authorization' => $request->get_header('authorization'),
                            "Accept: application/json")
    
)
);

$check_code = json_decode( wp_remote_retrieve_body( $response ) );

   if($check_code->data->status==200){

 print_r( $request->get_param('status')); // get body parameters
 exit;
}else{
    return new WP_Error(
           $check_code->code,
            array(
                'status' => $check_code->data->status,
            )
        );
        exit;
}  
  }  
    }
3
  • Welcome to the WordPress Development community! Ideally, answers should include some text describing how or why provided code solves the problem posed in the question. A few notes on this solution: it shouldn't be necessary to make an HTTP request from a WordPress installation to itself in order to validate a token. If the functionality is already available on the site, it would be much quicker to call the relevant function. Finally, as mentioned by Tom, authentication should not be performed in a request handler.
    – bosco
    Aug 18, 2022 at 15:48
  • actually i am going to give this endpoint to thrid party site when they are hitting this url i should check for authorized token validation.
    – mike
    Aug 22, 2022 at 9:50
  • Thank you!!! Really helped me
    – Assaf Katz
    Feb 3 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.