Why JWT authentication I’m building a site that uses WordPress as the back-end, and a React+Redux app as the front-end, so I’m pulling all the content in the front-end by making requests to the WordPress API. Some requests (mainly, POST requests) must be authenticated, which is when I came across JWT. What we need To … Read more
Is this meant to be used on sites in production? Yes. Many sites have been already using it. Is there a security risk to allowing endpoints to be viewed by anyone, such as /wp-json/wp/v2/users/ which shows all users registered to the site? No. Server responses have nothing to do with security, nothing you can do … Read more
It’s a good point by @Milo, the REST_REQUEST constant is defined as true, within rest_api_loaded() if $GLOBALS[‘wp’]->query_vars[‘rest_route’] is non-empty. It’s hooked into parse_request via: add_action( ‘parse_request’, ‘rest_api_loaded’ ); but parse_request fires later than init – See for example the Codex here. There was a suggestion (by Daniel Bachhuber) in ticket #34373 regarding WP_Query::is_rest(), but it … Read more
Posts: sitename.com/wp-json/wp/v2/posts?slug=post-slug Pages: sitename.com/wp-json/wp/v2/pages?slug=page-slug Custom post type: sitename.com/wp-json/wp/v2/POST_TYPE?slug=post-slug
This code snippet will hide the users, posts, and comments endpoint results and give 404 as the result, while the rest of the API calls keep running as they were. ::UPDATE:: add_filter(‘rest_endpoints’, function(){ $toRemove = [‘users’, ‘posts’, ‘comments’]; foreach($toRemove as $val) { if (isset($endpoints[‘/wp/v2/’.$val])) { unset($endpoints[‘/wp/v2/’.$val]); } if(isset($endpoints[‘/wp/v2/’.$val.’/(?P<id>[\d]+)’])) { unset($endpoints[‘/wp/v2/’.$val.’/(?P<id>[\d]+)’]); } } return $endpoints; }); … Read more
4.7 has it enabled by default. The easy way to check if it is working is just to visit the example.com/wp-json url, and you should get a list of registered end points there There is no official option to disable it as (at least there was a talk about it not sure if it got … Read more