Answering my own question. For plugin developers, the directive is to use current_user_can() in your code as usual in the REST endpoints, as Core does. WordPress 5.4 does not support authenticated requests originated from outside WordPress to the REST API yet. But your clients can use plugins such as Basic Auth, OAuth2 or JWT to … Read more
The problem is that this function is normally used in the backend. To use it in the frontend, you need to add the following filter: add_filter( ‘auth_redirect_scheme’, ‘wpse16975_check_loggedin’ ); function wpse16975_check_loggedin(){ return ‘logged_in’; } Then auth_redirect() will work as expected : redirect users to the login form if they are not logged in.
This question Set up WP Authentication from External API has a link to a blog. That put me in the right direction and shed some light on my work (Thanks @Rup). class CustomLogin { /** * Initializes the plugin. * * To keep the initialization fast, only add filter and action hooks in the constructor. … Read more
Not sure, but currently in my mind the first solution. Do you need the data from WordPress for the authentication. If you include the wp-load.php you have access to WordPress and his functions, maybe to identifier. But the file to include as static path is not really great and solid. define( ‘WP_USE_THEMES’, FALSE ); require( … Read more
Use the Authorization header. Example: $auth = base64_encode( $username . ‘:’ . $password ); $args = [ ‘headers’ => [ ‘Authorization’ => “Basic $auth” ], ‘body’ => $body, ]; $response = wp_remote_post( $url, $args ); $response_body = wp_remote_retrieve_body( $response );
Authorization header is usually stripped by Apache. You can fix it with .htaccess RewriteEngine On RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule .* – [e=HTTP_AUTHORIZATION:%1]
You can use the wp_loaded hook to push all non-logged-in traffic to the login screen. Note how I’ve passed $_SERVER[‘REQUEST_URI’] to wp_login_url() – this is passed as a URL parameter to the login page, and once a user successfully signs in, they’ll be redirected back to the URL they were originally trying to visit. function … Read more
‘Authenticate’: ‘Basic {what do I put here?}’ // Do I need “Basic”? No, it’s not Basic. It’s Bearer. And the header is Authorization. So first, obtain a token from /wp-json/jwt-auth/v1/token: fetch( ‘http://example.com/wp-json/jwt-auth/v1/token’, { method: ‘POST’, body: JSON.stringify( { // Username of a user on the WordPress website in which the REST API request // is … Read more
To answer my own question, when you use WP_Http, the transport used is selected, in this order, from this array: $request_order = array( ‘curl’, ‘streams’, ‘fsockopen’ ); If your PHP supports curl, WP_Http_Curl is used. Curl doesn’t support adding the body array parameters when the method is GET WP_Http_Streams and WP_Http_Fsockopen on the other hand, … Read more
I am also under same issues, it not only happen when you update a posts but also when you try to update your profile. Temporary fix: Log out of the wordpress panel. Clear or remove all the cookie. Log back in, remember to check remember me. This seems to solve the issue but as the … Read more