GET requests to the wp-api requires authentication

  • Resolved photocurio

    (@photocurio)


    7 years, 9 months ago

    I’m using GET requests to fetch data from a wordpress site running WP 4.7 (not the WP-API plugin). If I fetch a single post or a page, the API returns all data as expected.

    But if I try to fetch a collection of posts with a URL like this:

    https://devserver.corp.com/wp-json/wp/v2/posts

    it returns an empty array.

    I can test this by going to that URL (a dev server behind a firewall) in my browser. If I’m logged in to the WP site, I get an array of posts. If I log out, I get an empty array. Just two square brackets.

    But if I go to the endpoint for a single post, such as

    https://devserver.corp.com/wp-json/wp/v2/posts/855

    Then I always get a complete post object, if I’m logged in or not logged in.

    Does anyone know what’s going on? GET request should not require authentication.

    BTW, this is not a CORS issue. When I set up my app to do a GET request on a collection of posts, it returns an empty array and a 200 code. If I pass authentication with my request, it returns the array with data (but then its very slow).

    So I need to be able to do GET requests without authentication.

Viewing 3 replies - 1 through 3 (of 3 total)

  • I brought this up in slack, and one possible cause: are the posts that are in that collection private, password-protected, not published, or otherwise restricted in any way?

    To make sure I understand the issue, when you authenticate and get the first page of results, and take the ID of the first post in that collection, then /wp/v2/posts/{that id} works without authentication; but yet, the post that is publicly visible, published, and not password-protected does not show up (nor do any others) in the /posts collection when you are unauthenticated?

    Thread Starter photocurio

    (@photocurio)

    Kadam, that’s correct. None of the posts are private. All are published.

    Actually I just found the culprit: it was a plugin: Press Permit Core, a role scoping plugin.

    @photocurio Thanks for the update, I’m glad you found the cause! That one had me stumped

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘GET requests to the wp-api requires authentication’ is closed to new replies.