plugins - Wordpress usersme endpoint request forbidden

admin管理员组

文章数量:1334184

Using Wordpress's plugin WP REST API version 1, there is an endpoint called /users/me which response with data for the currently logged-in user. When I requested /users/me I got 403 Request Forbidden error. But If I requested /users/1 (where 1 is the user ID) then everything works. So why am I getting 403 error for /users/me endpoints? I'm using Postman to send my request:

THIS WORKS (userID 1 is the currently logged-in user):

={myAccessToken}

DOESN'T WORK:

={myAccessToken}

However, when using WP REST API version 2, /users/me works but it only returns a subset of what version 1 would have returned. The data is incomplete by comparison (i.e. email, first name, last name ...etc)

={myAccessToken}

{
    "avatar_urls": {
        "24": ";d=mm&r=g",
        "48": ";d=mm&r=g",
        "96": ";d=mm&r=g"
    },
    "description": "",
    "id": 1,
    "link": "/",
    "name": "admin",
    "url": "",
    "_links": {
        "self": [
            {
                "href": ""
            }
        ],
        "collection": [
            {
                "href": ""
            }
        ]
    }
}

Using Wordpress's plugin WP REST API version 1, there is an endpoint called /users/me which response with data for the currently logged-in user. When I requested /users/me I got 403 Request Forbidden error. But If I requested /users/1 (where 1 is the user ID) then everything works. So why am I getting 403 error for /users/me endpoints? I'm using Postman to send my request:

THIS WORKS (userID 1 is the currently logged-in user):

http://example/wp-json/users/1?access_token={myAccessToken}

DOESN'T WORK:

http://example/wp-json/users/me?access_token={myAccessToken}

However, when using WP REST API version 2, /users/me works but it only returns a subset of what version 1 would have returned. The data is incomplete by comparison (i.e. email, first name, last name ...etc)

http://example/wp-json/wp/v2/users/me?access_token={myAccessToken}

{
    "avatar_urls": {
        "24": "http://2.gravatar/avatar/29b3ef85f13fedb43f84e6cb4a634e73?s=24&d=mm&r=g",
        "48": "http://2.gravatar/avatar/29b3ef85f13fedb43f84e6cb4a634e73?s=48&d=mm&r=g",
        "96": "http://2.gravatar/avatar/29b3ef85f13fedb43f84e6cb4a634e73?s=96&d=mm&r=g"
    },
    "description": "",
    "id": 1,
    "link": "http://example/author/admin/",
    "name": "admin",
    "url": "",
    "_links": {
        "self": [
            {
                "href": "http://example/wp-json/wp/v2/users/1"
            }
        ],
        "collection": [
            {
                "href": "http://example/wp-json/wp/v2/users"
            }
        ]
    }
}

• plugins
• user-meta
• users
• rest-api

Share Improve this question asked Sep 19, 2015 at 2:18 Loc PhamLoc Pham 14911 silver badge99 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

The subset of data you are seeing is the publicly available author data. ie. if a user has published content on the site, their name, gravatar and description is deemed public data and available to un-authenticated requests.

If you're seeing this user data you can assume the access_token is invalid.

本文标签： pluginsWordpress usersme endpoint request forbidden