Changeset 41553

Timestamp:

09/21/2017 12:57:16 PM (9 years ago)

Author:

adamsilverstein

Message:

REST API JS Client: Improve nonce handling, refresh stale nonce on sync.

Keep the nonce used for cookie based authentication fresh by pulling in and using any new nonce supplied in the response headers.

• Enable passing nonce to init so each api/endpoint can use a unique nonce.
• Store nonce for endpoint on endpointModel.
• New model helper nonce() retrieves a model's routeModel nonce.
• When a response header contains a nonce that doesn't match the stored nonce, replace it.

Fixes #40422.

File:

• trunk/src/wp-includes/js/wp-api.js (modified) (7 diffs)

trunk/src/wp-includes/js/wp-api.js

@@ -794 +794 @@
                                 }
 
-                                if ( ! _.isUndefined( wpApiSettings.nonce ) && ! _.isNull( wpApiSettings.nonce ) ) {
+                                if ( _.isFunction( model.nonce ) && ! _.isUndefined( model.nonce() ) && ! _.isNull( model.nonce() ) ) {
                                         beforeSend = options.beforeSend;
 
@@ -800 +800 @@
                                         // options.dataType = 'jsonp';
 
+                                        // Include the nonce with requests.
                                         options.beforeSend = function( xhr ) {
-                                                xhr.setRequestHeader( 'X-WP-Nonce', wpApiSettings.nonce );
+                                                xhr.setRequestHeader( 'X-WP-Nonce', model.nonce() );
 
                                                 if ( beforeSend ) {
                                                         return beforeSend.apply( this, arguments );
+                                                }
+                                        };
+
+                                        // Update the nonce when a new nonce is returned with the response.
+                                        options.complete = function( xhr ) {
+                                                var returnedNonce = xhr.getResponseHeader( 'X-WP-Nonce' );
+
+                                                if ( returnedNonce && _.isFunction( model.nonce ) && model.nonce() !== returnedNonce ) {
+                                                        model.endpointModel.set( 'nonce', returnedNonce );
                                                 }
                                         };
@@ -1049 +1059 @@
                         apiRoot: wpApiSettings.root,
                         versionString: wp.api.versionString,
+                        nonce: null,
                         schema: null,
                         models: {},
@@ -1066 +1077 @@
 
                         model.schemaModel = new wp.api.models.Schema( null, {
-                                apiRoot: model.get( 'apiRoot' ),
-                                versionString: model.get( 'versionString' )
+                                apiRoot:       model.get( 'apiRoot' ),
+                                versionString: model.get( 'versionString' ),
+                                nonce:         model.get( 'nonce' )
                         } );
 
@@ -1239 +1251 @@
                                                 },
 
+                                                // Track nonces on the Endpoint 'routeModel'.
+                                                nonce: function() {
+                                                        return routeModel.get( 'nonce' );
+                                                },
+
+                                                endpointModel: routeModel,
+
                                                 // Include a reference to the original route object.
                                                 route: modelRoute,
@@ -1285 +1304 @@
                                                 },
 
+                                                // Track nonces at the Endpoint level.
+                                                nonce: function() {
+                                                        return routeModel.get( 'nonce' );
+                                                },
+
+                                                endpointModel: routeModel,
+
                                                 // Include a reference to the original route object.
                                                 route: modelRoute,
@@ -1406 +1432 @@
 
                 args                      = args || {};
+                attributes.nonce          = args.nonce || wpApiSettings.nonce || '';
                 attributes.apiRoot        = args.apiRoot || wpApiSettings.root || '/wp-json';
                 attributes.versionString  = args.versionString || wpApiSettings.versionString || 'wp/v2/';