WordPress.org

Make WordPress Core


Ignore:
Timestamp:
10/08/2020 10:12:02 PM (11 months ago)
Author:
TimothyBlynJacobs
Message:

REST API: Introduce Application Passwords for API authentication.

In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.

This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.

Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.

Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/user.php

    r48313 r49109  
    595595    );
    596596}
     597
     598/**
     599 * Checks if the Authorize Application Password request is valid.
     600 *
     601 * @since 5.6.0
     602 *
     603 * @param array   $request {
     604 *     The array of request data. All arguments are optional and may be empty.
     605 *
     606 *     @type string $app_name    The suggested name of the application.
     607 *     @type string $success_url The url the user will be redirected to after approving the application.
     608 *     @type string $reject_url  The url the user will be redirected to after rejecting the application.
     609 * }
     610 * @param WP_User $user The user authorizing the application.
     611 * @return true|WP_Error True if the request is valid, a WP_Error object contains errors if not.
     612 */
     613function wp_is_authorize_application_password_request_valid( $request, $user ) {
     614    $error = new WP_Error();
     615
     616    if ( ! empty( $request['success_url'] ) ) {
     617        $scheme = wp_parse_url( $request['success_url'], PHP_URL_SCHEME );
     618
     619        if ( 'http' === $scheme ) {
     620            $error->add(
     621                'invalid_redirect_scheme',
     622                __( 'The success url must be served over a secure connection.' )
     623            );
     624        }
     625    }
     626
     627    if ( ! empty( $request['reject_url'] ) ) {
     628        $scheme = wp_parse_url( $request['reject_url'], PHP_URL_SCHEME );
     629
     630        if ( 'http' === $scheme ) {
     631            $error->add(
     632                'invalid_redirect_scheme',
     633                __( 'The rejection url must be served over a secure connection.' )
     634            );
     635        }
     636    }
     637
     638    /**
     639     * Fires before application password errors are returned.
     640     *
     641     * @since 5.6.0
     642     *
     643     * @param WP_Error $error   The error object.
     644     * @param array    $request The array of request data.
     645     * @param WP_User  $user    The user authorizing the application.
     646     */
     647    do_action( 'wp_authorize_application_password_request_errors', $error, $request, $user );
     648
     649    if ( $error->has_errors() ) {
     650        return $error;
     651    }
     652
     653    return true;
     654}
Note: See TracChangeset for help on using the changeset viewer.