Permission callbacks in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a permission callback returns false?

In WordPress REST API, if a permission callback returns false, what is the expected behavior when a client tries to access that endpoint?

Wordpress

register_rest_route('myplugin/v1', '/data', [
  'methods' => 'GET',
  'callback' => 'myplugin_get_data',
  'permission_callback' => 'myplugin_check_permission'
]);

function myplugin_check_permission() {
  return false;
}

A The API returns the data but logs a warning in the server.

B The API returns a 403 Forbidden error to the client.

C The API returns a 404 Not Found error to the client.

D The API ignores the permission callback and returns the data.

💡 Hint

Think about what permission denied means in web APIs.

When a permission callback returns false, WordPress REST API responds with a 403 Forbidden status. This means the client is not allowed to access the endpoint.

📝 Syntax

intermediate

Identify the correct permission callback syntax

Which of the following is the correct way to define a permission callback for a REST API route in WordPress?

Wordpress

register_rest_route('myplugin/v1', '/item', [
  'methods' => 'POST',
  'callback' => 'myplugin_create_item',
  'permission_callback' => ???
]);

A current_user_can('edit_posts')

B myplugin_check_permission()

C function() { return current_user_can('edit_posts'); }

D 'myplugin_check_permission'

💡 Hint

Remember, permission_callback expects a callable, not the result of a function call.

The permission_callback must be a callable function name or closure. Passing the function name as a string is correct. Calling the function immediately (with parentheses) is wrong.

🔧 Debug

advanced

Why does this permission callback cause a fatal error?

Consider this permission callback function:

function myplugin_permission() {
  return current_user_can('edit_posts') ? true : false;
  echo 'Check permission';
}

Why does this cause a fatal error?

Wordpress

register_rest_route('myplugin/v1', '/check', [
  'methods' => 'GET',
  'callback' => 'myplugin_callback',
  'permission_callback' => 'myplugin_permission'
]);

A The function lacks a required parameter for permission callbacks.

B The echo statement after return causes unreachable code error.

C The function returns a boolean but should return a WP_Error object.

D The function name is not a valid callable.

💡 Hint

Check the function signature against how WordPress calls permission callbacks (with $request).

WordPress REST API calls permission callbacks with a WP_REST_Request argument. Defining the function without a parameter causes a PHP ArgumentCountError (fatal error) when called.

❓ state_output

advanced

What is the output when permission callback returns WP_Error?

If a permission callback returns a WP_Error object instead of true or false, what will the REST API response be?

Wordpress

function myplugin_permission() {
  return new WP_Error('rest_forbidden', 'You do not have permission', ['status' => 403]);
}

register_rest_route('myplugin/v1', '/error', [
  'methods' => 'GET',
  'callback' => 'myplugin_callback',
  'permission_callback' => 'myplugin_permission'
]);

A The API returns a 403 error with the message 'You do not have permission'.

B The API ignores the WP_Error and returns the callback data.

C The API returns a 500 Internal Server Error.

D The API returns a 200 OK with empty data.

💡 Hint

WP_Error objects are used to send error responses in WordPress REST API.

Returning a WP_Error from permission_callback causes the REST API to send the error status and message to the client.

🧠 Conceptual

expert

Why use permission callbacks instead of checking permissions inside the main callback?

Why is it better to use a permission_callback in WordPress REST API routes rather than checking permissions inside the main callback function?

A Permission callbacks automatically log user activity, main callbacks do not.

B Permission callbacks are required by WordPress and main callbacks cannot check permissions.

C Permission callbacks prevent unauthorized users from triggering expensive operations in the main callback.

D Permission callbacks run after the main callback to verify results.

💡 Hint

Think about performance and security when handling API requests.

Using permission callbacks stops unauthorized requests early, avoiding running costly code in the main callback. This improves security and efficiency.