WordPress.org

Plugin Directory

Disable REST API and Require JWT / OAuth Authentication

這個外掛並未在最新的 3 個 WordPress 主要版本上進行測試。開發者可能不再對這個外掛進行維護或提供技術支援,並可能會與更新版本的 WordPress 產生使用上的相容性問題。

Disable REST API and Require JWT / OAuth Authentication

描述

When you activate this plugin, all REST API endpoints will be disabled for non-authorized requests.

Best used with any of these plugins:

Blocks ALL REST API endpoints except for:

  • /jwt-auth/v1/token/validate
  • /jwt-auth/v1/token
  • /oauth/authorize
  • /oauth/token
  • /oauth/me

Allows all REST API endpoints if they come with a valid Bearer Token Authentication (authentication via GET URL variables are still blocked)

When used alone in your site, your REST API will essentially be disabled.

Note that this plugin itself doesn’t provide JWT or OAuth authentication, it only whitelists them.

Features

  • No settings page
  • You can whitelist other REST API endpoint via a filter hook (see FAQs below)
  • Blocks all REST API endpoints.. but
  • Allows requests with Bearer Token Authentication.. and
  • Allows JWT Authentication for WP REST API & WP OAuth Server authentication endpoints

螢幕截圖

  • Blocked REST API requests
  • Authenticated REST API requests are allowed

安裝

  1. Head over to Plugins > Add New in the admin
  2. Search for “Disable REST API and Require Authentication”
  3. Install & activate the plugin
  4. Now your REST API endpoints are disabled for non-authenticated requests.

常見問題

Installation Instructions
  1. Head over to Plugins > Add New in the admin
  2. Search for “Disable REST API and Require Authentication”
  3. Install & activate the plugin
  4. Now your REST API endpoints are disabled for non-authenticated requests.
How is this different from Disable REST API?

This plugin is similar to Disable REST API, wherein it disables all REST API endpoints, but it still allows the authentication endpoints provided by:

And if a Bearer Token Authentication is provided, then the REST API becomes available.

How can I check if my REST API is disabled?

Open a new incognito browser tab or private browser tab and visit your wp-json URL:

http://mysite/wp-json/

You will see this message:

{"code":"rest_not_logged_in","message":"You are not currently logged in.","data":{"status":401}}

What is a Bearer Token Authenticated REST API request?

A Bearer Token Authenticated REST API request is a REST API call with this header:

Authorization: Bearer XXXXXXX

The XXXXXXX corresponds to the authentication token given by any of these 2 plugins:

How do I implement JWT / OAuth authentication?

That is outside the scope of this plugin, please refer to the docs of the respective plugins:

How do I whitelist other REST API endpoints? (via filter hook)

I’ve placed a filter called reqauth/allowed_endpoints where you can add your own REST API endpoints to the whitelist.

For example, I want to allow /my-endpoint for non-authorized REST API calls:

add_filter( 'reqauth/allowed_endpoints', 'allow_my_endpoints' );
function( $allowed_endpoints ) {
    $allowed_endpoints[] = '/my-endpoint';
    return $allowed_endpoints;
}

評價

There are no reviews for this plugin.

貢獻者及開發者

“Disable REST API and Require JWT / OAuth Authentication” 是一個開源的軟體。以下的人對這個外掛作出了貢獻。

貢獻者

修改日誌

v1.0

  • Initial release