29 votes
Accepted

How to: Make JWT-authenticated requests to the Wordpress API

Why JWT authentication I'm building a site that uses Wordpress as the back-end, and a React+Redux app as the front-end, so I'm pulling all the content in the front-end by making requests to the ...
user avatar
  • 1,188
15 votes

Can I programmatically login a user without a password?

I have found another solution here that uses a better approach (at least in my opinion...). No need to set any cookie, it uses the Wordpress API: /** * Programmatically logs a user in * * @param ...
user avatar
  • 526
14 votes

How to use OAuth authentication with REST API via CURL commands?

Let's go step by step here. Looks like you're trying to use OAuth just for authentication, but before you can do so you need to get the Access Token which will be used to authenticate when you make ...
user avatar
  • 2,683
10 votes
Accepted

Set up WP Authentication from External API

Update: Made a blog post to explain this better :) I was able to do this by WP's authenticate filter inside a new plugin; most of which is guided by this tutorial by Ben Lobaugh. Major points on the ...
user avatar
  • 283
9 votes

Wordpress REST API - Permission Callbacks

The issue was because I wasn't generating and sending a nonce value with the request. In order to generate a nonce value. Localize the value of a wp_create_nonce('wp_rest') function call. ...
user avatar
  • 183
8 votes
Accepted

JWT authentication with WP - Approach

This showed up as a notification due to the upvote. Here's how I solved it. The endpoint coded in the app that I am supposed to authenticate with prepares the token. The token has to be in the ...
user avatar
8 votes

How to: Make JWT-authenticated requests to the Wordpress API

Complementing @grazianodev's answer, this is how you get your authorization token using cURL: /** * Generate a JWT token for future API calls to WordPress */ private function getToken() { $ch = ...
user avatar
7 votes
Accepted

Extend Wordpress (4.x) session and nonce

Your problem is that you call wp_logout_url immediately after wp_set_auth_cookie. wp_set_auth_cookie() does some setcookie() calls. Unfortunately setcookie doesn't make the new value available ...
user avatar
7 votes

Can I programmatically login a user without a password?

This works well for me: clean_user_cache($user->ID); wp_clear_auth_cookie(); wp_set_current_user($user->ID); wp_set_auth_cookie($user->ID, true, false); update_user_caches($user);
user avatar
  • 340
7 votes
Accepted

How to login to WordPress site using basic authentication HTTP headers?

I would just hook into determine_current_user filter and check HTTP basic auth data to return the user. Maybe, just maybe, I would allow only specific user to be logged via HTTP auth. That could be ...
user avatar
  • 44.6k
6 votes

How do I require authorization / login to view a specific set of posts / pages?

This is just a modification of timshutes' answer - if you want specific pages to require login and don't want to put them into a custom post type, you can add to functions.php: add_shortcode('...
user avatar
  • 261
6 votes
Accepted

Authentication / login mechanism (non wp-admin)

You can use the wp_loaded hook to push all non-logged-in traffic to the login screen. Note how I've passed $_SERVER['REQUEST_URI'] to wp_login_url() - this is passed as a URL parameter to the login ...
user avatar
  • 34.8k
6 votes
Accepted

how to authenticate for the REST API from a plugin and from command line

GET requests, like listing posts, doesn't need authentication at least you need to get private posts. Your problem is that you are using a route/endpoint that doesn't exist. In WordPress 4.4, WP REST ...
user avatar
  • 19.7k
6 votes
Accepted

Can I authenticate with both WooCommerce consumer key and JWT?

Yes this is possible by structuring your requests appropriately. For system requests use OAuth 1.0 (consumer key as before), but encode it to include the OAuth credentials in the URL not in the ...
user avatar
6 votes

How to Authenticate WP REST API with JWT Authentication using Fetch API

'Authenticate': 'Basic {what do I put here?}' // Do I need "Basic"? No, it's not Basic. It's Bearer. And the header is Authorization. So first, obtain a token from /wp-json/jwt-auth/v1/token: fetch(...
user avatar
  • 31.4k
5 votes
Accepted

How to secure or disable the RSS feeds?

As pointed out in the comments by @kaiser, your question is very similar to this question. In fact, the question itself holds the answer. To disable all feeds add the following code... function ...
user avatar
  • 213
5 votes
Accepted

How can I use CURLOPT_USERPWD in wp_remote_post?

Use the Authorization header. Example: $auth = base64_encode( $username . ':' . $password ); $args = [ 'headers' => [ 'Authorization' => "Basic $auth" ], 'body' => $...
user avatar
  • 105k
5 votes

wp-admin AJAX with Fetch API is done without user

After some fiddling and sparring with @t-todua I found the issue: With the Fetch API fetch call you must manually set to send cookies with a request. After setting the credentials option properly the ...
user avatar
  • 187
4 votes

WordPress auto login after registration not working

Short answer - Your original function (mostly) works. This is your function edited to do what it needs to do: function automatically_log_me_in( $user_id ) { wp_set_current_user( $user_id ); ...
user avatar
  • 4,400
4 votes
Accepted

How does the "authentication unique keys and salts" feature work?

Basically, they're hashing salts. They're used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts. AUTH is used for the /wp-...
user avatar
  • 32k
4 votes
Accepted

WP REST API: check if user is logged in

You shouldn't pass your nonce to your JavaScript to verify it, since client side scripts can be easily manipulated. Instead, you should get the nonce from your front-end content, and then pass it to ...
user avatar
  • 14.6k
4 votes
Accepted

Rest API basic auth not working

The REST API does not support basic authentication out of the box, you need a plugin. The documentation points to this one, accompanied by this warning: Note that this plugin requires sending your ...
user avatar
4 votes
Accepted

WordPress Rest API: How do we validate with our custom API key?

function checkApiAuth( $result ){ $yourEncryptAPIKey = $_GET['request']; if( yourDecryptFn( $yourEncryptAPIKey ) === $realKey ): $result = true; else: $result = false; ...
user avatar
  • 258
4 votes
Accepted

Rest API authentication issue when called from fetch request in bundle.js

The problem is that you're not using the correct name for the REST API nonce header — the correct name is X-WP-Nonce, but you used X-WP-Header: fetch('http://localhost/wptest2/?rest_route=/wp/...
user avatar
  • 31.4k
4 votes
Accepted

Can we access the REST request parameters from within the permission_callback to enforce a 401 by returning false?

I've created a reduced test case that demonstrates that what you want to do is achievable: add_action( 'rest_api_init', function() { register_rest_route( 'wpse/343039', ...
user avatar
3 votes
Accepted

Are there ways of logging in that bypass wp-login.php altogether?

The answer is most likely XML-RPC which is used to communicate with the mobile wordpress apps and is always on in newer versions. If you don't use mobile apps to admin your WP you can use my plugin - ...
user avatar
  • 22.6k
3 votes
Accepted

Wordpress Authentication Middleware

Here is part of a multisite plugin I wrote that forces a user to log in. It required a user to be registered for the site; not just be a network user. It could be modified to check if user has a ...
user avatar
  • 1,601
3 votes
Accepted

How to set a cookie for logged in users to md5($user->ID . "my_secret")?

Nevermind, I've figured it out: function init() { $user = wp_get_current_user(); if (!$user instanceof WP_User) ...
user avatar
3 votes

Can I programmatically login a user without a password?

In addition to Mike, Paul and Sjoerd: To better handle login.php redirections: //---------------------Automatic login-------------------- if(!is_user_logged_in()){ $username = "user1"; if(...
user avatar
  • 335
3 votes

How to use OAuth authentication with REST API via CURL commands?

Adding this as another answer to give you help to figure out how to do this. Basically as mentioned in my comments if you're going to use OAuth1 you MUST associate it with a user account, no way ...
user avatar
  • 2,683

Only top scored, non community-wiki answers of a minimum length are eligible