WordPress REST API Basic Auth / Authentication Method involves the REST APIs access on validation against the API token generated based on the user’s username,password and on basis of client credentials. Each time a request to access the API will be made, the authentication will be done against that token, and on the basis of the verification of the API token, the resources for that API request will be allowed to access.
1. By User credentials:
Suppose you have one Android/IOS Blog Application and you have given capabilities to your users to post their personal feeds or blogs using mobile applications. In this case, your mobile application requests should be authenticated. Basic Authentication with username and password method appropriate for this situation where your users will be in Authorization Header. It will authenticate the user's request and assign blogs to them respectively.
2. By Client credentials:
Suppose you have one Android/IOS Blog Application and you want to sign up new users from the client application. Now, In this case, you can use Basic Authentication with username: password but you don't want to send admin users into your header and at each request, there will be two users present. First one Admin user (In Authorization header) and the other one new user which is going to create. In that case, you should use Basic Authentication with a client ID and client secret where your admin user is also safe, and at each request, you don't have to put two users. Hence security is not a concern.
Request: GET https://<domain-name>/wp-json/wp/v2/posts
Header: Authorization : Basic base64encoded <username:password>
Sample request: GET https://<domain-name>/wp-json/wp/v2/posts
Header: Authorization : Basic eGw2UllOdFN6WmxKOlNMRWcwS1ZYdFVrbm5XbVV2cG9RVFNLZw==
Example => username : testuser and password : password@123
base64_encode(‘testuser:password@123’) will result into
‘eGw2UllOdFN6WmxKOlNMRWcwS1ZYdFVrbm5XbVV2cG9RVFNLZw==’ as output.
Request: GET https://<domain-name>/wp-json/wp/v2/posts
Header: Authorization : Basic base64encoded <client-id:client-secret>
Sample request: GET https://<domain-name>/wp-json/wp/v2/posts
Header: Authorization : Basic eGw2UllOdFN6WmxKOlNMRWcwS1ZYdFVrbm5XbVV2cG9RVFNLZw==
Example => Client ID : pSYQsKqTndNVpNKcnoZd and Client Secret = SrYPTViHdCbvkWyTfWrSltavTMeJjaOHCye
base64_encode(‘pSYQsKqTndNVpNKcnoZd:SrYPTViHdCbvkWyTfWrSltavTMeJjaOHCye’) will results into
cFNZUXNLcVRuZE5WcE5LY25vWmQ6U3JZUFRWaUhkQ2J2a1d5VGZXclNsdGF2VE1lSmphT0hDeWU= as output.Follow the steps below to make REST API request using Postman:
1. Role Based REST API restriction:
This feature allows restricting the REST API access based on the user roles. You can whitelist the roles for which you want to allow access to the requested resource for the REST APIs. So whenever a REST API request is made by a user, his role will be fetched and only allowed to access the resource if his role is whitelisted.
How to configure it?
Note: The Role based restriction feature is valid for Basic authentication(Username: password), JWT method, and OAuth 2.0 (Password grant).
2. Custom Header
This feature provides an option to choose a custom header rather than the default ‘Authorization’ header.
It will increase the security as you have the header named with your ‘custom name’, so if someone makes the REST API request with a header as ‘Authorization’ then he won’t be able to access the APIs.
How to configure it?
3. Exclude REST APIs
This feature allows you to whitelist your REST APIs so these can be accessed directly without any authentication. Hence all these whitelisted REST APIs are publicly available.
How to configure it?
4. Custom Token Expiry
This feature is applicable for JWT and OAuth 2.0 methods which uses time based tokens to authenticate the WordPress REST API endpoints. This feature allows you to set the custom expiry for the tokens such that the token will no longer be valid once the token expires.
How to configure it?
Hence, with this custom token expiry feature, the security is increased furthermore.
5. Enable Advanced Encryption for the tokens using HMAC
This feature is available with the Basic Authentication method in which by default the token is encrypted using Base64 encoding technique but with the advanced feature, the token can be encrypted with highly secure HMAC encryption which is very secure.
6. Signature Validation for JWT based tokens
This feature allows a secure signing of the JWT signature for the JWT token such that your JWT token is much more secure and the signature can only be decoded using the client secret/certificate. It means your signature is private and can not be seen by others.
We provide the support for 2 Signing algorithms: HS256 and RS256.So, any of the signing algorithms can be chosen from the dropdown as shown in the above image.
Also, you need to add your client secret or certificate from which is used to sign the signature of the JWT.
7. Create User Specific API key/tokens
How to use this feature:
Mail us on oauthsupport@xecurify.com for quick guidance(via email/meeting) on your requirement and our team will help you to select the best suitable solution/plan as per your requirement.
Need Help? We are right here!
