How to use WordPress REST api to login a user?

Question

There are 3 ways to authenticate a user using a REST api end-point request,

1- using cookies, which is the way WordPress keeps track of authenticated users in POST requests. You pass the authentication details in your REST request, use the wp_signon() function to sign-in your user, and if successful you set the authentication cookie using wp_set_auth_cookie() function,

$creds = array(
    'user_login'    => 'example',
    'user_password' => 'plaintextpw',
    'remember'      => true
);

$user = wp_signon( $creds, false );

if ( is_wp_error( $user ) ) {
    $msg = $user->get_error_message();
}else{
  wp_clear_auth_cookie();
  wp_set_current_user ( $user->ID ); // Set the current user detail
  wp_set_auth_cookie  ( $user->ID ); // Set auth details in cookie
  $msg = "Logged in successfully"; 
}

You can find a discussion on this WordPress forum thread.

2- Using Basic Authentication requests to your own server

the idea here is that for every REST request you make to your server you pass the user’s credentials (every time) over an SSL connection. The WordPress API group provides a plugin on their GitHub repo to do this for you, which allows you to encode the user’s credentials and decode it on the other side to authenticate them, so for example, to delete a user’s post on the server,

let user="...", pw='...';
jQuery.ajax({
   url: 'http://your-domain/wp-json/wp/v2/posts/50',
   method: 'DELETE',
   crossDomain: true,
   beforeSend: function ( xhr ) {
       xhr.setRequestHeader( 'Authorization', 'Basic ' + Base64.encode( user + ':' + pw ) );
   },
   success: function( data, txtStatus, xhr ) {
       console.log( data );
       console.log( xhr.status );
   }
});

For more details see this detailed tutorial

3- user a third party authentication such the open OAuth.

This is what Google uses, and allows your site to identify users based on their Google login credentials. WordPress.com also uses this method for its blog service authentication.

The idea is that your users logs-in a server which identifies them (using cookies on their browser).

Once authenticated, your page (reactive js) makes a request to the authentication authority/server which if confirmed by the user returns an access token which is used to authenticate REST requests going forward.

You could use a third party authentication service, such Google, in which case you can follow this youtube tutorial which walks you through the basics to setting up a Google API project to allow your application to make authentication requests.

Alternatively, you could convert your WordPress server into a OAuth server using an existing plugin such as WP-OAuth Server, and its extensive documentation.

Related Posts: