Authentication for API in Wordpress - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add basic authentication headers in a WordPress API request.

Wordpress

fetch('https://example.com/wp-json/wp/v2/posts', {
  headers: {
    'Authorization': '[1]'
  }
})

Drag options to blanks, or click blank then click option'

A'Bearer ' + token

B'Basic ' + btoa('username:password')

C'Token ' + apiKey

D'OAuth ' + oauthToken

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Bearer' instead of 'Basic' for basic auth

Not encoding username and password

Using OAuth tokens in basic auth header

Basic authentication in WordPress REST API uses the 'Basic' prefix followed by base64 encoded username and password.

2fill in blank

medium

Complete the code to register a REST API route with permission callback in WordPress.

Wordpress

register_rest_route('myplugin/v1', '/data', [
  'methods' => 'GET',
  'callback' => 'myplugin_get_data',
  'permission_callback' => [1]
]);

Drag options to blanks, or click blank then click option'

Afunction() { return false; }

Bfunction() { return true; }

Cfunction() { return is_user_logged_in(); }

Dfunction() { return current_user_can('edit_posts'); }

Attempts:

3 left

💡 Hint

Common Mistakes

Returning true always, which makes endpoint public

Returning false always, blocking access

Not using a function for permission_callback

The permission callback should check user capabilities, like 'edit_posts', to secure the API endpoint.

3fill in blank

hard

Fix the error in the code to correctly verify a JWT token in WordPress REST API authentication.

Wordpress

add_filter('rest_authentication_errors', function($result) {
  if (!empty($result)) {
    return $result;
  }
  $token = getallheaders()['Authorization'] ?? '';
  if ($token && !verify_jwt_token([1])) {
    return new WP_Error('jwt_auth_invalid_token', 'Invalid token', ['status' => 403]);
  }
  return true;
});

Drag options to blanks, or click blank then click option'

A$token

Bexplode(' ', $token)[1]

Ctrim(str_replace('Bearer ', '', $token))

Dsubstr($token, 7)

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the whole header string including 'Bearer '

Not handling missing Authorization header

Using wrong string manipulation to extract token

The token string usually starts with 'Bearer ', so we remove that prefix before verifying.

4fill in blank

hard

Fill both blanks to create a WordPress REST API endpoint that requires a nonce for authentication.

Wordpress

register_rest_route('myplugin/v1', '/secure', [
  'methods' => 'POST',
  'callback' => 'myplugin_secure_callback',
  'permission_callback' => function() {
    return wp_verify_nonce([1], [2]);
  }
]);

Drag options to blanks, or click blank then click option'

Asanitize_text_field($_POST['nonce'])

B'myplugin_nonce'

Csanitize_text_field($_REQUEST['_wpnonce'])

D'wp_rest'

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong request field for nonce

Using incorrect action name in wp_verify_nonce

Not sanitizing nonce input

Nonce is usually sent in '_wpnonce' request field and verified against 'wp_rest' action for REST API security.

5fill in blank

hard

Fill the blanks to implement OAuth 1.0a authentication in WordPress REST API.

Wordpress

add_filter('rest_pre_dispatch', function($response, $server, $request) {
  $oauth = new OAuthConsumer([1], [2]);
  if (!$oauth->verifyRequest($request)) {
    return new WP_Error('oauth_error', 'Invalid OAuth signature', ['status' => 401]);
  }
  return $response;
}, 10, 3);

Drag options to blanks, or click blank then click option'

A'consumer_key_here'

B'consumer_secret_here'

C'access_token_here'

D'access_token_secret_here'

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up consumer and access tokens

Not passing correct parameters to OAuthConsumer

Ignoring OAuth verification errors

OAuthConsumer requires consumer key and secret for verifying requests.