How we can verify “Cancel the header auth” the “endpoint” functions of WordPress with an API key that we produce. (Note: not a different endpoint, original endpoints)

I have my own “Crypto” class/function. In the request, I need to send an encrypted key, “decrypt” the “encrypted key” from “wp-function” and so on, and allow the request.

I need to be able to do all of this on wordpress own endpoint libraries.

A simple example of my query structure:

$.ajax({
  type: "POST",
  url: "http://localhost/workspace/wordpress/wp-json/wp/v2/posts?request=<?php echo $encrypted; ?>",
  dataType: "json"
});

PHP

<?php echo $encrypted; ?>
<?php // "z0/8Q6cuMWBlZGzfTwOVi9HwCpKThN9Ju/o/MywK74vimB467vjGfKqoDVQdyKIdmXCxxE=" ?>

functions.php or e.g. php page: After Decrypt

<?php echo $decrypted; ?>
<?php // "Secret Password" ?>
<?php // I will verify my key, and to let

enter image description here

enter image description here

2 Answers
2

function checkApiAuth( $result ){

    $yourEncryptAPIKey = $_GET['request'];

    if( yourDecryptFn( $yourEncryptAPIKey ) === $realKey ):
        $result = true;

    else:
        $result = false;

    endif;

    return $result;           
}
add_filter('rest_authentication_errors', 'checkApiAuth');

Leave a Reply

Your email address will not be published. Required fields are marked *