WP rest api endpoint protection using jwt token

admin管理员组

文章数量:1122846

I have been trying to validate jwt token inside theme function.php file.

I am not sure how to pass this jwt token validate inside this hook function. The following function is working without authorization header also I need to protect the endpoint using jwt authorization without this it should throw a error. lot of example showing javascript based function to fetch the details.

add_action( 'rest_api_init', function ($data) {
    register_rest_route( 'jwt-auth/v1', 'sci', array(
       'methods' => 'POST', 
        'callback' => 'update_payment_history',
        'permission_callback' => '__return_true' 
    ) );  
    
  /*  register_rest_route( 'v1', 'certificates', array(
       'methods' => 'POST', 
        'callback' => 'update_payment_history',
        'permission_callback' => '__return_true' 
    ) ); */
    
    
    register_rest_route( 'jwt-auth', 'v1/token', array(
       'methods' => 'POST', 
        'callback' => 'gettoken',
        'permission_callback' => '__return_true' 
    ) );
    
    
  
    
    
    
} );

function update_payment_history(WP_REST_Request $request) {
print_r( $request->get_param('transaction_id'));
 exit;
}

I have been trying to validate jwt token inside theme function.php file.

I am not sure how to pass this jwt token validate inside this hook function. The following function is working without authorization header also I need to protect the endpoint using jwt authorization without this it should throw a error. lot of example showing javascript based function to fetch the details.

add_action( 'rest_api_init', function ($data) {
    register_rest_route( 'jwt-auth/v1', 'sci', array(
       'methods' => 'POST', 
        'callback' => 'update_payment_history',
        'permission_callback' => '__return_true' 
    ) );  
    
  /*  register_rest_route( 'v1', 'certificates', array(
       'methods' => 'POST', 
        'callback' => 'update_payment_history',
        'permission_callback' => '__return_true' 
    ) ); */
    
    
    register_rest_route( 'jwt-auth', 'v1/token', array(
       'methods' => 'POST', 
        'callback' => 'gettoken',
        'permission_callback' => '__return_true' 
    ) );
    
    
  
    
    
    
} );

function update_payment_history(WP_REST_Request $request) {
print_r( $request->get_param('transaction_id'));
 exit;
}

• rest-api

Share Improve this question edited Aug 16, 2022 at 15:03 Tom J Nowell♦ 60.7k77 gold badges7777 silver badges147147 bronze badges asked Aug 16, 2022 at 14:06 mikemike 2144 bronze badges 4

• 2 there's already JWT authentication plugins, it would be much safer to use one of those rather than rolling your own security. Also JWT has questionable safety that requires going above and beyond to secure – Tom J Nowell ♦ Commented Aug 16, 2022 at 15:02
• are you asking how to check for JWT tokens in update_payment_history? If so, the answer is you do not, that's the function that handles the endpoint if the user has permission, JWT and authentication happens elsewhere. Have you checked the REST API handbooks section on authentication? – Tom J Nowell ♦ Commented Aug 16, 2022 at 15:04
• Yes how to check the jwt token is valid or not in update_payment_history function inside – mike Commented Aug 17, 2022 at 9:17
• 1 you don't, that's not how you implement custom authentication in the REST API, have you looked at wordpress.org/plugins/jwt-authentication-for-wp-rest-api ? Or are you already using that plugin? If so you need to share that information. You are meant to authenticate before a callback is handled, not inside it. There is no information here on how you implemented JWT – Tom J Nowell ♦ Commented Aug 17, 2022 at 11:48

Add a comment  | 

2 Answers 2

Sorted by: Reset to default 2

Once user hit the api endpoint will check the token valid or not and process the function send information to wordpress api end point with success details.

 function update_payment_history(WP_REST_Request $request) {      
   if(!$request->get_header('authorization')){
 return new WP_Error(
            'jwt_auth_no_auth_header',
            'Authorization header not found.',
            array(
                'status' => 403,
            )
        );
        exit;
 } else if($request->get_header('authorization')){ 

  $response = wp_remote_post( 'https://example.com/wp-json/jwt- 
   auth/v1/token/validate', array(

'headers'     =>array(
                        'Authorization' => $request->get_header('authorization'),
                            "Accept: application/json")
    
)
);

$check_code = json_decode( wp_remote_retrieve_body( $response ) );

   if($check_code->data->status==200){

 print_r( $request->get_param('status')); // get body parameters
 exit;
}else{
    return new WP_Error(
           $check_code->code,
            array(
                'status' => $check_code->data->status,
            )
        );
        exit;
}  
  }  
    }

so many words

function check_jwt_token() {
    $auth = apply_filters('determine_current_user', null);

    if (empty($auth)) {
        return new WP_Error('rest_forbidden', __('The token was not found or is invalid.'), array('status' => 403));
    }

    return true;
}

and then

    register_rest_route('wp/v2', '/bla-bla/bla', array(
        'methods' => 'POST',
        'callback' => 'bla-bla',
        'permission_callback' => 'check_jwt_token'
    ));

本文标签： WP rest api endpoint protection using jwt token