Authentication

The plugin author has removed any in code authentication methods and simply put a filter hook; json_authentication_errors. So, handling authentication is up to you. If you want to use oAuth, there is a plugin/extension for this json rest api that handles most of the code for you. https://github.com/WP-API/WP-API/blob/master/docs/authentication.md

I use the basic auth like so:

curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type:application/json", "Accept:application/json", 'Authorization:Basic '. base64_encode($username.":".$password)));

To hook into the filter, you would do something like this:

function MineCheckAuth(){
//do check auth stuff, basic authentication in the headers will be
//stored in either the
//$_SERVER["REMOTE_AUTHORIZATION"] global or
//$_SERVER["REDIRECT_REMOTE_AUTHORIZATION"]

//log user in if good

return true; //or return wp_error
//neither will do anything but he states that these are the two valid return values.
}
add_filter('json_authentication_errors', 'MineCheckAuth');

Author does hook into the auth errors filter, but only to verify nonce in wp cookie auth.

/**
 * Check for errors when using cookie-based authentication
 *
 * WordPress' built-in cookie authentication is always active for logged in
 * users. However, the API has to check nonces for each request to ensure users
 * are not vulnerable to CSRF.
 *
 * @param WP_Error|mixed $result Error from another authentication handler, null if we should handle it, or another value if not
 * @return WP_Error|mixed|boolean
 */
function json_cookie_check_errors( $result ) {
	if ( ! empty( $result ) ) {
		return $result;
	}

	global $wp_json_auth_cookie;

	// Are we using cookie authentication?
	// (If we get an auth error, but we're still logged in, another
	// authentication must have been used.)
	if ( $wp_json_auth_cookie !== true && is_user_logged_in() ) {
		return $result;
	}

	// Do we have a nonce?
	$nonce = null;
	if ( isset( $_REQUEST['_wp_json_nonce'] ) ) {
		$nonce = $_REQUEST['_wp_json_nonce'];
	}
	elseif ( isset( $_SERVER['HTTP_X_WP_NONCE'] ) ) {
		$nonce = $_SERVER['HTTP_X_WP_NONCE'];
	}

	if ( $nonce === null ) {
		// No nonce at all, so act as if it's an unauthenticated request
		wp_set_current_user( 0 );
		return true;
	}

	// Check the nonce
	$result = wp_verify_nonce( $nonce, 'wp_json' );
	if ( ! $result ) {
		return new WP_Error( 'json_cookie_invalid_nonce', __( 'Cookie nonce is invalid' ), array( 'status' => 403 ) );
	}

	return true;
}
add_filter( 'json_authentication_errors', 'json_cookie_check_errors', 100 );

Thanks a lot dunar 21.

Your welcome. If this works for you, you can mark as resolved.

Yes, thank you dunar21. Anyway I feel that the basic auth is not so secure for production, isn’t it? I’m more like trying the OAuth one, let’s see if I succeed in this as documentation is not very clear (at least for me!)

Marked as resolved.

Yeah, basic Auth probably should be avoided. You should do some google searching on how how OAuth works before trying to delve into it. I just provided you the basic because that is what your original post was doing. Here is a well laid out, easy to understand explanation of OAuth: https://marktrapp.com/blog/2009/09/17/oauth-dummies/ Good luck.

Thanks a lot again, you have been really helpfull.