Changeset 41553

Timestamp:

09/21/2017 12:57:16 PM (7 years ago)

Author:

adamsilverstein

Message:

REST API JS Client: Improve nonce handling, refresh stale nonce on sync.

Keep the nonce used for cookie based authentication fresh by pulling in and using any new nonce supplied in the response headers.

• Enable passing nonce to init so each api/endpoint can use a unique nonce.
• Store nonce for endpoint on endpointModel.
• New model helper nonce() retrieves a model's routeModel nonce.
• When a response header contains a nonce that doesn't match the stored nonce, replace it.

Fixes #40422.

File:

• trunk/src/wp-includes/js/wp-api.js (modified) (7 diffs)

trunk/src/wp-includes/js/wp-api.js

@@ -794 +794 @@
                 }
 
-                if ( ! _.isUndefined( wpApiSettings.nonce ) && ! _.isNull( wpApiSettings.nonce ) ) {
+                if ( _.isFunction( model.nonce ) && ! _.isUndefined( model.nonce() ) && ! _.isNull( model.nonce() ) ) {
                     beforeSend = options.beforeSend;
 
@@ -800 +800 @@
                     // options.dataType = 'jsonp';
 
+                    // Include the nonce with requests.
                     options.beforeSend = function( xhr ) {
-                        xhr.setRequestHeader( 'X-WP-Nonce', wpApiSettings.nonce );
+                        xhr.setRequestHeader( 'X-WP-Nonce', model.nonce() );
 
                         if ( beforeSend ) {
                             return beforeSend.apply( this, arguments );
+                        }
+                    };
+
+                    // Update the nonce when a new nonce is returned with the response.
+                    options.complete = function( xhr ) {
+                        var returnedNonce = xhr.getResponseHeader( 'X-WP-Nonce' );
+
+                        if ( returnedNonce && _.isFunction( model.nonce ) && model.nonce() !== returnedNonce ) {
+                            model.endpointModel.set( 'nonce', returnedNonce );
                         }
                     };
@@ -1049 +1059 @@
             apiRoot: wpApiSettings.root,
             versionString: wp.api.versionString,
+            nonce: null,
             schema: null,
             models: {},
@@ -1066 +1077 @@
 
             model.schemaModel = new wp.api.models.Schema( null, {
-                apiRoot: model.get( 'apiRoot' ),
-                versionString: model.get( 'versionString' )
+                apiRoot:       model.get( 'apiRoot' ),
+                versionString: model.get( 'versionString' ),
+                nonce:         model.get( 'nonce' )
             } );
 
@@ -1239 +1251 @@
                         },
 
+                        // Track nonces on the Endpoint 'routeModel'.
+                        nonce: function() {
+                            return routeModel.get( 'nonce' );
+                        },
+
+                        endpointModel: routeModel,
+
                         // Include a reference to the original route object.
                         route: modelRoute,
@@ -1285 +1304 @@
                         },
 
+                        // Track nonces at the Endpoint level.
+                        nonce: function() {
+                            return routeModel.get( 'nonce' );
+                        },
+
+                        endpointModel: routeModel,
+
                         // Include a reference to the original route object.
                         route: modelRoute,
@@ -1406 +1432 @@
 
         args                      = args || {};
+        attributes.nonce          = args.nonce || wpApiSettings.nonce || '';
         attributes.apiRoot        = args.apiRoot || wpApiSettings.root || '/wp-json';
         attributes.versionString  = args.versionString || wpApiSettings.versionString || 'wp/v2/';