0

I have this code in my custom plugin. I've created an application password and I want to check it every time a custom endpoint is called.

        register_rest_route( 
            $this->namespace, 
            '/activation-check', 
            array(
                'methods' => 'GET',
                'callback' => array($this, 'send_activation_emails'),
                'permissions_callback' => function( WP_REST_Request $request ){
                    $application_password = $request->get_header('Authorization');
                    if(empty($application_password)){
                        return new WP_Error(
                            'Forbidden',
                            __('Forbidden'),
                            array(
                                'status' => 403
                            )
                        );
                    } else {
                        //
                        $user = wp_check_application_passwords($application_password);
                        //
                        if(is_wp_error($user)){
                            return new WP_Error(
                                'Forbidden',
                                __('Invalid application password'),
                                array(
                                    'status' => 403
                                )
                            );
                        } else {
                            return true;
                        }
                    }

                }
            ) 
        );

I've noticed that the endpoint will use the callback also if no authorization header is sent with the ajax requests. Is there something I can do prevent that the endpoint can give sensistive data if the application password isn't provided?

Improve this question
12
  • 1
    I believe the application password just authorises the request as coming from the user who the password belongs to. So your permissions callback should just be the normal permissions check for the user's role/capability/authorship. You shouldn't need to authenticate the password yourself.
    – Jacob Peattie
    Oct 30 at 10:58
  • I need to check the application password because I'm calling this custom endpoint from a nodejs script. If the application password is present, I will need to do some code stuff otherwise return 403. I don't want to replace normal user login with this.
    – ICTDEV
    Oct 30 at 11:33
  • @JacobPeattie can you show an example of checking?
    – ICTDEV
    Oct 30 at 11:36
  • 1
    developer.wordpress.org/rest-api/extending-the-rest-api/…
    – Jacob Peattie
    Oct 30 at 12:10
  • 1
    @ICTDEV I’ve explained that you’re not supposed to check the password. If the user permissions check passes then it means the application password is valid. The permissions_callback check should be agnostic towards the authentication method.
    – Jacob Peattie
    Oct 30 at 18:29

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.