Permission callbacks in Wordpress - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a permission callback in WordPress REST API?

A permission callback is a function that checks if the current user has the right to access or modify a REST API endpoint. It returns true if allowed, false otherwise.

beginner

Why do we use permission callbacks when registering REST API routes?

Permission callbacks protect REST API routes by ensuring only authorized users can access or change data, helping keep the site secure.

intermediate

How do you define a permission callback when registering a REST route in WordPress?

You add a 'permission_callback' key in the route arguments, assigning it a function that returns true or false based on user capabilities.

beginner

What happens if a permission callback returns false?

The REST API request is denied with a 403 Forbidden error, preventing unauthorized access.

intermediate

Give an example of a simple permission callback function in WordPress.

function my_permission_callback() { return current_user_can('edit_posts'); } This allows only users who can edit posts to access the route.

What does a permission callback function return to allow access?

A an error message

B true

C null

D false

Permission callbacks must return true to allow access to the REST API endpoint.

Where do you specify the permission callback when registering a REST route?

A In the 'args' argument

B In the 'callback' argument

C In the 'methods' argument

D In the 'permission_callback' argument

The 'permission_callback' argument is used to define the function that checks user permissions.

What HTTP status code is returned if permission callback denies access?

A 200 OK

B 404 Not Found

C 403 Forbidden

D 500 Internal Server Error

A 403 Forbidden status code indicates the user is not allowed to access the resource.

Which WordPress function is commonly used inside permission callbacks to check capabilities?

A current_user_can()

B wp_enqueue_script()

C get_post()

D register_rest_route()

current_user_can() checks if the current user has a specific capability.

If no permission callback is set, what is the default behavior for REST API routes?

A Access is allowed to everyone

B Access is denied to everyone

C Access depends on the HTTP method

D Access depends on user role

By default, REST API routes are public unless a permission callback restricts access.

Explain what a permission callback is and why it is important in WordPress REST API.

Think about who can use your API and how you check that.

Describe how to add a permission callback when registering a REST API route in WordPress.

Focus on the arguments passed to register_rest_route.