0

Currently working on generating Application Passwords on the fly. I have an android app that is successful in getting a JWT from my WordPress instance. It can validate and i can read and update posts without issue (in testing..)

Im currently trying to generate an application password for the users programmatically so its not reliant on Java Web Tokens. I'm testing with the RESTED plugin for Firefox, but im not able to get the endpoint to authenticate with my tokens..

The API endpoint it always generating some variation of this:

I have tested the following end points:

  • /wp-json/wp/v2/users/me/application-passwords/ This results in:
{
  "code": "rest_not_logged_in",
  "message": "You are not currently logged in.",
  "data": {
    "status": 401
  }
}
  • `/wp-json/wp/v2/users/1/application-passwords/ This resulted in:
{
  "code": "rest_cannot_create_application_passwords",
  "message": "Sorry, you are not allowed to create application passwords for this user.",
  "data": {
    "status": 401
  }
}

neither will authenticate with JWT. I am running WP 6 with cloud flare as my DNS provider but they are not set to proxy the connection. Everything I've read so far mentions my .htaccess not being correct. But if that were the case then it shouldn't be able to validate the tokens either.

Just for reference, my HTACCESS is pastebined. https://pastebin.com/P8NVpWqL Form data of RESTED submission Response of the submission

1
  • noting that the REST API does not have JWT functionality, if you've implemented this yourself you must share it, if you've implemented it using a plugin then you must ask this at their support route or in a more general WordPress community as questions about working with 3rd party plugins are offtopic here and not in this stacks scope. Note that there is no way to create new sessions in the REST API by default, only users who are already authenticated can create application passwords using an authenticated request. Users who are not logged in and do not currently have a session cannot.
    – Tom J Nowell
    Commented May 7, 2023 at 15:27

1 Answer 1

1

Because what you're trying to do boils down to the fundamental question:

How do I log in to WordPress using only the REST API?

The answer: You can't in stock/vanilla WordPress..

/wp-json/wp/v2/users/me/application-passwords/

"message": "You are not currently logged in.", or

"code": "rest_cannot_list_application_passwords"

and

/wp-json/wp/v2/users/1/application-passwords/

"message": "Sorry, you are not allowed to create application passwords for this user.",

Are both expected and normal responses because:

  • if you make a request to /wp-json/wp/v2/users/me/application-passwords/ how would it know who "me" is? You have to be logged in and authenticated to use this endpoint
  • likewise, only someone logged in as the user with ID 1 or an administrator can use the /wp-json/wp/v2/users/1/application-passwords/ endpoint, both endpoints require an authenticated request.
  • additionally, the endpoint is not intended for viewing passwords, just for creating them, and only creating them for already logged in users. If you could list all the application passwords it would be a major security breach as you wouldn't be able to invalidate a password reliably without a malicious app reading that endpoint and grabbing the others, forcing you to invalidate all application passwords and eliminating one of the major advantages of the system.

Core provides 2 methods of authentication:

  • a session cookie with a REST API nonce, where the cookie was created by using the standard WordPress login process in a browser
  • a pre-configured application password, setup prior by the user or an administrator via the users profile page in WP Admin.

It is not possible to create and use these using only the REST API, hence the need to install additional plugins.

A lot of independent developers use JWT to work around this as it's easier to implement, despite the security issues with the JWT system.

Enterprise and more experienced agencies use OAuth2, including wordpress.com and core official recommendations. Neither of these provide mechanisms for registration however, and neither are bundled in WordPress and require the installation of 3rd party plugins.

3
  • But even when I am logged in as an admin on the website and I navigate there, I can't see it. wp-json/wp/v2/users/2/application-passwords/ --> this even gives me a 401 error saying: "code": "rest_cannot_list_application_passwords". Why is that then?
    – Johan
    Commented Dec 14, 2023 at 13:26
  • because if you could view every application password the security of the feature would be devastated, think of it like asking someone for a list of their passwords! They're obviously going to say no even if they trust you are who you say you are. That endpoint can be used to create new application passwords by already authenticated users. It can't be used to list them or as a way to login and start new sessions
    – Tom J Nowell
    Commented Dec 14, 2023 at 15:26
  • @Johan I've updated the answer to account for that particular situation, but keep in mind new questions should be asked as new questions, not comments. Being able to list all application passwords on a user is a major security breach that defeats the point of application passwords. Why give each application a password that can be revoked if they can look up eachothers passwords in an API request?
    – Tom J Nowell
    Commented Dec 14, 2023 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.