Authentication for API in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of using OAuth2 in WordPress REST API authentication?

OAuth2 is a common method for API authentication. What does it mainly help with in WordPress REST API?

A It allows users to authenticate without sharing their passwords directly with the client app.

B It automatically encrypts all API data sent between client and server.

C It disables all other authentication methods to improve security.

D It stores user passwords in a special encrypted database.

💡 Hint

Think about how OAuth2 helps users keep their passwords safe when using third-party apps.

OAuth2 lets users authorize apps to access their data without giving out their password, improving security and user control.

❓ component_behavior

intermediate

What happens when you send a REST API request to WordPress without authentication for a protected route?

Consider a WordPress REST API route that requires authentication. What will the server respond if you call it without any authentication?

A The server crashes and stops responding.

B The server returns the requested data without any restrictions.

C The server returns a 401 Unauthorized error response.

D The server returns a 404 Not Found error response.

💡 Hint

Think about what HTTP status code means 'you need to log in first'.

Protected routes require authentication. Without it, WordPress returns a 401 Unauthorized error to indicate access is denied.

📝 Syntax

advanced

Which code snippet correctly adds Basic Authentication support to WordPress REST API?

Choose the code snippet that properly enables Basic Authentication for WordPress REST API requests.

A add_filter('rest_authentication_errors', function($result) { if (empty($_SERVER['PHP_AUTH_USER'])) { return new WP_Error('rest_not_logged_in', 'You are not logged in.', array('status' => 401)); } return $result; });

B add_action('rest_authentication_errors', function($result) { if (!empty($_SERVER['PHP_AUTH_USER'])) { return true; } return $result; });

C add_filter('rest_authentication_errors', function($result) { if (!empty($_SERVER['PHP_AUTH_USER'])) { return true; } return $result; });

D add_filter('rest_authentication_errors', function() { return true; });

💡 Hint

Look for the filter hook that checks if the PHP_AUTH_USER is empty and returns an error if so.

The 'rest_authentication_errors' filter lets you check authentication. Returning a WP_Error with status 401 denies access properly.

❓ state_output

advanced

What is the output of this WordPress REST API authentication check code?

Given the following code snippet inside a REST API callback, what will be the output if the user is not logged in?

Wordpress

<?php
function my_api_callback() {
  if (!is_user_logged_in()) {
    return new WP_Error('rest_forbidden', 'You must be logged in.', array('status' => 403));
  }
  return array('message' => 'Welcome!');
}
?>

A PHP Fatal error: Call to undefined function is_user_logged_in()

B {"message":"Welcome!"}

C null

D {"code":"rest_forbidden","message":"You must be logged in.","data":{"status":403}}

💡 Hint

Think about what happens when the user is not logged in and the function returns a WP_Error.

The function returns a WP_Error with status 403, which the REST API converts to a JSON error response with code and message.

🔧 Debug

expert

Why does this WordPress REST API authentication code always allow access even without credentials?

Examine the code below. It is intended to restrict access to authenticated users only. Why does it fail to do so?

add_filter('rest_authentication_errors', function($result) {
  if (!empty($_SERVER['PHP_AUTH_USER'])) {
    return true;
  }
  return $result;
});

A The filter should return false to block unauthenticated users, not true.

B Returning true from 'rest_authentication_errors' means no error, so unauthenticated users are allowed access.

C Returning true from 'rest_authentication_errors' means authentication passed, so unauthenticated users are blocked correctly.

D The code is missing a check for $_SERVER['PHP_AUTH_PW'], so it always fails.

💡 Hint

Check what returning true or an error from this filter means for access control.

In 'rest_authentication_errors', returning true means no error occurred, so access is granted. To block access, you must return a WP_Error instead.