Creating Application Password using REST API results in 401 regardless of JWT token

Question

Currently working on generating Application Passwords on the fly. I have an android app that is successful in getting a JWT from my WordPress instance. It can validate and i can read and update posts without issue (in testing..)

Im currently trying to generate an application password for the users programmatically so its not reliant on Java Web Tokens. I'm testing with the RESTED plugin for Firefox, but im not able to get the endpoint to authenticate with my tokens..

The API endpoint it always generating some variation of this:

I have tested the following end points:

• /wp-json/wp/v2/users/me/application-passwords/ This results in:

{
  "code": "rest_not_logged_in",
  "message": "You are not currently logged in.",
  "data": {
    "status": 401
  }
}

• `/wp-json/wp/v2/users/1/application-passwords/ This resulted in:

{
  "code": "rest_cannot_create_application_passwords",
  "message": "Sorry, you are not allowed to create application passwords for this user.",
  "data": {
    "status": 401
  }
}

neither will authenticate with JWT. I am running WP 6 with cloud flare as my DNS provider but they are not set to proxy the connection. Everything I've read so far mentions my .htaccess not being correct. But if that were the case then it shouldn't be able to validate the tokens either.

Just for reference, my HTACCESS is pastebined. https://pastebin.com/P8NVpWqL

Answer 1

Because what you're trying to do boils down to the fundamental question:

How do I log in to WordPress using only the REST API?

The answer: You can't in stock/vanilla WordPress.

/wp-json/wp/v2/users/me/application-passwords/

"message": "You are not currently logged in.",

and

/wp-json/wp/v2/users/1/application-passwords/

"message": "Sorry, you are not allowed to create application passwords for this user.",

Are both expected and normal responses because:

• if you make a request to /wp-json/wp/v2/users/me/application-passwords/ how would it know who "me" is? You have to be logged in and authenticated to use this endpoint
• likewise, only someone logged in as the user with ID 1 or an administrator can use the /wp-json/wp/v2/users/1/application-passwords/ endpoint, both endpoints require an authenticated request.

Core provides 2 methods of authentication:

• a session cookie with a REST API nonce, where the cookie was created by using the standard WordPress login process in a browser
• a pre-configured application password, setup prior by the user or an administrator via the users profile page in WP Admin.

It is not possible to create and use these using only the REST API, hence the need to install additional plugins.

A lot of independent developers use JWT to work around this as it's easier to implement, despite the security issues with the JWT system.

Enterprise and more experienced agencies use OAuth2, including wordpress.com and core official recommendations. Neither of these provide mechanisms for registration however, and neither are bundled in WordPress and require the installation of 3rd party plugins.