Hi

Thanks for the plugin; it all works great, and when I test it in postman it all works fine.

However, if I try to “login” within a wordpress function (using the exact credentials in the body I used in postman), I get an “unknown username” error. I am guessing I am not perhaps calling the login endpoint correctly?

Here’s how I am calling it (I have omitted error checking lines for clarity):

$url = 'https://testsite.net/wp-json/api-bearer-auth/v1/login';
$apw = 'a-test-app-password-for-admin-user-called-testuser' ;

$args = array( ? ? ? ? ? ? ?
? ? 'body' => array(
? ? ? ? "username" => "testuser",
? ? ? ? "password" ?=> $apw,
? ? ? ? "client_name" => "api-bearer",
? ? ),
);

$response = wp_remote_post( $url, $args );
$body = wp_remote_retrieve_body( $response );
$data = json_decode( $body );    // Error checking gives the unknown username error?

$bt = isset( $data->access_token ) ? $data->access_token : null;
$rt = isset( $data->refresh_token ) ? $data->refresh_token : null;

Like I said, in postman, doing a POST to the URL above with a body of:

{ “username”: “testuser”, “password”: “a-test-app-password-for-admin-user-called-testuser”, “client_name”: “api-bearer” }

…works fine. Any ideas where I am messing up, please?

Thanks, Adam

Hi!

I’m in trouble with this.

I read the topics about this with the same problem, but I cannot solve it.

I’ve got last version of the pluggin.

In my local server everything it’s fine, in my server test everything it’s fine, but in the final production server I’ve got this:

{
"code": "api_bearer_auth_not_logged_in",
"message": "You are not logged in.",
"data": {
"status": 401
}
}

Here it’s my .htaccess

# BEGIN WordPress
# Las directivas (líneas) entre ?BEGIN WordPress? y ?END WordPress? son
# generadas dinámicamente y solo deberían ser modificadas mediante filtros de WordPress.
# Cualquier cambio en las directivas que hay entre esos marcadores serán sobrescritas.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* – [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{HTTP:Authorization} ^(.*)
# Don’t know why, but some need the line below instead of the RewriteRule line
# SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0
RewriteRule ^(.*) – [E=HTTP_AUTHORIZATION:%1]
RewriteBase /
RewriteRule ^index\.php$ – [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

I’m using WordPress as a Headless, but the thing is that in Postman I cannot either, same message.

?Is the problem with the production server? Or should I check something else?

Thanks a lot

I’m having trouble allowing Royal Mail shipping provider to work. if I disable the plugin it works correctly however I need to enable it to protect the endpoints. I have tried to open up these:
for GET,POST,PUT AND DELETE however it still does not work.

$custom_urls[] = '/wp-json/wc/v1/orders?';
			$custom_urls[] = '/wp-json/wc/v3/sc/coupons?';
			$custom_urls[] = '/wp-json/wc/v3/reports?';
			$custom_urls[] = '/wp-json/wc/v3/customers?';
			$custom_urls[] = '/wp-json/wc/v3/webhooks?';

Hi! You have incorrect comment in FAQ in docs:

define('API_BEARER_ACCESS_TOKEN_VALID_IN_SECONDS', 3600); // 1 minute

This is 1 hour in fact.

• This topic was modified 2 years, 2 months ago by Lev Nikolaevich.

{
“success”: false,
“statusCode”: 403,
“code”: “jwt_auth_bad_auth_header”,
“message”: “Authorization header malformed.”,
“data”: []
}

hello everyone!

as we know, adapt our plugin to DB structure of WP is still a best practice.

I apreciate your work @michielve, but i have a doubt to real exigence of a users_token table.

I have modified your DB class to adapt the queries using usermeta table.

If you want, i can send to you my work.

Let me know.

Michele.

We are getting the following error when we attempt to fetch an authentication token. We are using WordPress Multisite 5.7.2.

{
    "code": "api_api_bearer_auth_create_token",
    "message": "Error creating tokens.",
    "data": null
}

• This topic was modified 3 years, 5 months ago by robertasystyou.
• This topic was modified 3 years, 5 months ago by robertasystyou. Reason: Fix code block

I have everything working like I would like and am now trying to activate a PWA plugin. The login process works and returns a good user with tokens and is saved, then its used to fetch data from unprotected pages. In these pages I look for a logged in user and verify they have access to extra information and append it when appropriate. All of this works like it should when the PWA is deactivated.

However, when the PWA plugin is active and I check for a valid user I get a current user id of 0 and is the source of my confusion in previous posts. I understand that as your plugin works as advertised, but there is a conflict and I am trying to sort this out the best I can. Do you have any suggestions as to what I may look for within the backend to see why I am not seeing a logged in user?

Hey,

Great plugin btw, This might be common knowledge to most / available after a short google but I had a nightmare getting my local development server to stop stripping auth headers.

This small snippet in a test php file on your server could save minutes if not hours of debugging 401’s due to auth headers being stripped.

Might be worth adding into the readme, will show “[Authorization] => Bearer…” if the .htaccess rule has worked (as it didn’t initially my case locally):

$requestHeaders = apache_request_headers();
print_r($requestHeaders);

I have been able to get this plugin to work just fine with users who are registered in the sub blog. However, now I am now trying to log in users who are paid members and only tracked and controlled within the main blog. Adding the user to (or having them join) the sub blog will lose the data needed for their membership level. How can I hook in to your plugin and switch the blog id to 1 so all users credentials are verified from there?

I have made a couple of custom endpoints within my API and I am looking for a way to implement the use of your plugin with it.

This is what I have tried so far from within my response function for one of my end points.

var_dump(wp_get_current_user());
die();

The results are a user object with ID = 0;

From what I can tell from looking through the plugin code I should be able to use the function wp_get_current_user() since the filter used within this plugin to load the current user is within that wordpress function. However, when I attempt to use that function I get an empty user object.

I’m having trouble with some urls that I’m trying to whitelist.

But I don’t understand why some work and others don’t … and said

{
“code”: “api_bearer_auth_not_logged_in”,
“message”: “You are not logged in.”,
“data”: {
“status”: 401
}
}

For example:

`switch ($request_method) {
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/comercios/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/catcomercios/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/restaurante/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/bonos/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/bono/v1/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/servicios/?’;OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/promociones/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/productos/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/posts/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/zonas/?’; OK
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v1/users/password/?’; ERROR
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v1/users/register/?’; ERROR
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/campana_bonos/?’; ERROR
break;
case ‘GET’:
$custom_urls[] = ‘/wp-json/wp/v2/campana_bonos/?per_page=100’; ERROR
break;
case ‘POST’:
$custom_urls[] = ‘/wp-json/wp/v1/users/password/’; ERROR
break;
case ‘POST’:
$custom_urls[] = ‘/wp-json/wp/v1/users/register/’; ERROR
break;
case ‘GET’:
$custom_urls[] = ‘https://lasrozasmarket.es/wp-json/bono/v1/userid/?/campana/?&#8217;; ERROR
break;
}

Could you help me?
thanks

After login how to edit user informations response?
I need user informations to be in this way
//’wp_user’ => $safeUser,
‘data’ => array(
‘id’ => $user->ID,
’email’ => $user->user_email,
‘userName’ => $user->user_nicename,
‘firstName’ => $user->first_name,
‘lastName’ => $user->last_name,
),
‘access_token’ => $result[‘access_token’],

//’expires_in’ => $result[‘expires_in’],

‘refresh_token’ => $result[‘refresh_token’],

I’m implementation a solution where I need to obtain a bearer token from a different domain (running a solution in a Docker app). Is there a way to enable/support CORS?

Groet,

Erik

Notice: register_rest_route was called incorrectly. The REST API route definition for api-bearer-auth/v1/login is missing the required permission_callback argument. For REST API routes that are intended to be public, use __return_true as the permission callback. Please see Debugging in WordPress for more information. (This message was added in version 5.5.0.) in /var/www/html-dev/wp-includes/functions.php on line 5225

Notice: register_rest_route was called incorrectly. The REST API route definition for api-bearer-auth/v1/tokens/refresh is missing the required permission_callback argument. For REST API routes that are intended to be public, use __return_true as the permission callback. Please see Debugging in WordPress for more information. (This message was added in version 5.5.0.) in /var/www/html-dev/wp-includes/functions.php on line 5225

Please add this line

'permission_callback' => '__return_true',

to register_rest_route in function rest_api_init_action()

I have a problem: I use api to work with android and ios applications. I have more than one application. I save tokens in the application and work with them so that I don’t have to log (to auth) in many times. If there is one application, then everything works perfectly, but if there are already two, then a problem arises. Authorization in any application destroys authorization in others because the refresh token is updated (is changed). I can solve the problem by saving the username and password on the device and logging in again each time, but this is a serious security blow that almost completely removes the meaning of using tokens (and I can’t using a few apps at the same time). How can I solve this problem? Maybe make multiple refresh tokens or not refresh refresh token on re-authorization?

• This topic was modified 4 years, 2 months ago by harchvertelol.
• This topic was modified 4 years, 2 months ago by harchvertelol.
• This topic was modified 4 years, 2 months ago by harchvertelol.

A some hostings set all letters in headers to small letters. And we have ‘authorization’, but not ‘Authorization’. Can you please fix it?
Fast fix is adding else one element to headers:
$possibleAuthHeaderKeys = [‘Authorization’, ‘authorization’, ‘HTTP_AUTHORIZATION’, ‘REDIRECT_HTTP_AUTHORIZATION’];

But maybe you set all letters in headers to small, and in you array set all letters to small?

Thank you!

Hi,

I’m creating a new project and in this project I have custom post types with the option “show_in_rest” like this example below:
https://developer.www.ads-software.com/rest-api/extending-the-rest-api/adding-rest-api-support-for-custom-content-types/

But when I enable the plugin, all requests to the endpoint returns 404 and when I disable the plugin the requests work again.

Example Route:
https://localhost:9005/wp-json/wp/v2/tier

Return When the plugin is enabled:

{
    "code": "rest_no_route",
    "message": "Nenhuma rota foi encontrada que corresponde com o URL e o método de requisi??o",
    "data": {
        "status": 404
    }
}

This is an awesome plugin, with a simple implementation and I want to continue using it, then if you need more explanation or help for tests, I will be appreciated to help you.

Thanks!

Hi,

First of all, thank you very much for this plugin, it works great!

I have a question about security. When using the login API, the data returned contains a lot of informations, e.g the ‘data’ object has the user_pass hashed in it. I find this quite concerning, as I believe the user pass should not be transmitted in any way, hashed or not.

What do you think?

Thanks in advance

Laetitiad

• This topic was modified 4 years, 3 months ago by laetitiad.
• This topic was modified 4 years, 3 months ago by laetitiad.

I found a big error (sort of). Actions:

1) We log in in the standard way, get an access token and a refresh token for the ‘test ‘ user.
Request body:
{“username”: “test”, “password”: “123”}
2) I make a request for /wp-json/wp/v2/users/me and get the user test. Fine!
3) I take the refresh token, call /wp-json/api-bearer-auth/v1/tokens/refresh without header. I am not putting authentication in the header. I get a new access token.
Request body:
{“token”: “… refresh token …”}
4) I take the received new access token, put it in the authorization header and call /wp-json/wp/v2/users/me again. I get the ‘admin’ user. admin has id = 1.

This is definitely a very serious bug. It turns out that any user can get administrative rights simply by having a refresh token.

WordPress 5.4.2
API Bearer 20200717

Also change user password not set access and refresh tokens to invalid

Me using postman for tests.

• This topic was modified 4 years, 3 months ago by harchvertelol.
• This topic was modified 4 years, 3 months ago by harchvertelol.
• This topic was modified 4 years, 3 months ago by harchvertelol.
• This topic was modified 4 years, 3 months ago by harchvertelol.

Hi, I’m not able to get the token from the React app that I’m working on.

When I try to make a POST call with the Fetch API to the endpoint “/api-bearer-auth/v1/login” with the credentials to get the token, I get a rejected response with an 401 Unauthorized status.

Access to fetch at 'https://rest.xxxxxxx.com/wp-json/jwt-auth/v1/token' from origin 'https://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

This doesn’t happen when I do it from Postman, apparently, as said here the way how postman and the browser send the OPTIONS request are different, and it seems that with this plugin is demanding authorization on the the pre-flight OPTIONS request, what should not be required.

I’ve tried with other plugins like “JWT Auth” and “JWT Authentication for WP REST API”, and it works perfectly but I would prefer to use this one as it offers refresh token, and protects all the endpoints, not like the others.

I hope you can give a solution for this, or something I could tweak.

Regards,
Jorge.

I installed this plugin to test the user registration flow from the mobile app, before this I was using JWT Auth plugin with no issues except registering a user. With your plugin I could register a user by whitelisting the register link but all other end points throwing error saying api_bearer_auth_not_logged_in and “You are not logged in.”. Could you tell me how I have to access other end points with this plugin. For ex: https://www.test.com/wp-json/wp/v2/posts this works with JWT aut but with this plugin I get the above error.

Hi,

Whatever i do is the same error. (I use Postman) Please; Can you help with this?
{
“code”: “api_bearer_auth_not_logged_in”,
“message”: “You are not logged in.”,
“data”: {
“status”: 401
}
}

SS1
SS1

Best Regards

• This topic was modified 4 years, 5 months ago by demokrasi.

Prob a newbie question. I’m creating a round trip where my WordPress plugin is calling an external system using a non blocking Rest call. At some point the system needs to respond back to WordPress via a custom end point in my plugin.

I think I need to create the token upon sending the request to the external system and let that system use the token at some point to update WordPress. Is this assumption correct? Or would I create a user specifically for the external system and let that request a token upon responding?

Groet,

Erik

Hello! I successfully added endpoint ‘/wp-json/wp/v2/posts’ to whitelist, but I still can’t open particular post.
My question is – what endpoint I must write to make available without authorization every post? Something like: ‘/wp-json/wp/v2/posts/{ID}’
Putting * in place of {ID} is not working.

add_filter('api_bearer_auth_unauthenticated_urls', 'api_bearer_auth_unauthenticated_urls_filter', 10, 2);
function api_bearer_auth_unauthenticated_urls_filter($custom_urls, $request_method) {
  switch ($request_method) {
    case 'POST':
      $custom_urls[] = '/wp-json/wp/v2/users/register';
      break;
    case 'GET':
      $custom_urls[] = '/wp-json/wp/v2/posts';
      break;
  }
  return $custom_urls;
}

Hi Michiel,

Your plugin works great, but I did find an issue when trying to whitelist a custom api route on my Bedrock site.

The problem comes when the plugin gets here: /web/app/plugins/api-bearer-auth/api-bearer-auth.php:185

In Bedrock, get_site_url() will return “www.mysite.com/wp” which is the location of the core WordPress files. I manually changed it to get_home_url() and it works.

Is this something you can change?

Thanks,
John

I have installed the plugin and made a successful request to get access token. Now I make my request with the token but I don’t know which user sends the request.

Where do you put the user’s information? I didn’t see any information about this on docu.

thanks.