WordPress REST API OAuth 2.0 Authentication Method involves the use of OAuth protocol to obtain the access or Id token and that token will be used to authenticate the REST APIs. Each time a request to access the API will be made, the authentication will be done against that access token/id token, and on the basis of the verification of that API token, the resources for that API request will be allowed to access.
1. Password Grant:
Use Case: Authenticate/ protect WordPress REST API Endpoints securely using user credentials obtained on user registration or login into WordPress
Suppose you have a login form in your application and want to authenticate the WordPress REST API endpoints on the basis of the user credentials and their capabilities, then you can easily authenticate the REST API endpoints very securely using this method. This method follows the standard OAuth 2.0 flow/protocol and our plugin acts both as a OAuth 2.0 Identity provider(Server) that will be used to provide the access/id token REST API request and REST API authenticator for authentication of the REST APIs endpoints on the basis of the token.
2. Client Credentials:
Use Case: Authenticate/ protect WordPress REST API Endpoints securely without using user credentials.
If in case you do not want to send user credentials in the WordPress REST API endpoint request to obtain method then you can opt for this method as it follows the OAuth 2.0 client credentials flow/protocol and our plugin acts both as a OAuth 2.0 Identity provider(Server) which provides the token and REST APIs authenticator for authentication of these WordPressREST API endpoints on the basis of the token. Hence it provides utmost security to obtain the token and that token can be used to authenticate the REST API request.
1. The REST API request will be made with appropriate parameters to obtain the token for our plugin. Our plugin will act as an OAuth 2.0 Identity provider and provides the access token.
2. The actual REST API request to access the resource will be made with the access token received from the last step passed in the Authorization header with token type as Bearer. The plugin now acts as Authenticator to authenticate the API on the basis of token validity. If the token is validated successfully then the API requester will be allowed to access the resource else on the failed validation the error response will be returned.
Request: POST https://<domain-name>/wp-json/api/v1/token
Body:
grant_type = <password>
username = <wordpress username>
password = <wordpress password>
client_id = <client id>
Request: POST https://<domain-name>/wp-json/api/v1/token
Body:
grant_type = <password>
refresh_token = <Refresh Token>
Request: GET https://<domain-name>/wp-json/wp/v2/posts
Header:
Authorization : Bearer <access_token /id_token>
Request: POST https://<domain-name>/wp-json/api/v1/token
Body:
grant_type = <client_credentials>
client_id = <client id>
client_secret = <client secret>
Request: POST https://<domain-name>/wp-json/api/v1/token
Body:
grant_type = <refresh_token>
refresh_token = <Refresh Token>
Request: GET https://<domain-name>/wp-json/wp/v2/posts
Header:
Authorization : Bearer <access_token /id_token>
1. Role Based REST API restriction:
This feature allows restricting the REST API access based on the user roles. You can whitelist the roles for which you want to allow access to the requested resource for the REST APIs. So whenever a REST API request is made by a user, his role will be fetched and only allowed to access the resource if his role is whitelisted.
How to configure it?
Note: The Role based restriction feature is valid for Basic authentication(Username: password), JWT method, and OAuth 2.0 (Password grant).
2. Custom Header
This feature provides an option to choose a custom header rather than the default ‘Authorization’ header.
It will increase the security as you have the header named with your ‘custom name’, so if someone makes the REST API request with a header as ‘Authorization’ then he won’t be able to access the APIs.
How to configure it?
3. Exclude REST APIs
This feature allows you to whitelist your REST APIs so these can be accessed directly without any authentication. Hence all these whitelisted REST APIs are publicly available.
How to configure it?
4. Custom Token Expiry
This feature is applicable for JWT and OAuth 2.0 methods which uses time based tokens to authenticate the WordPress REST API endpoints. This feature allows you to set the custom expiry for the tokens such that the token will no longer be valid once the token expires.
How to configure it?
Hence, with this custom token expiry feature, the security is increased furthermore.
5. Enable Advanced Encryption for the tokens using HMAC
This feature is available with the Basic Authentication method in which by default the token is encrypted using Base64 encoding technique but with the advanced feature, the token can be encrypted with highly secure HMAC encryption which is very secure.
6. Signature Validation for JWT based tokens
This feature allows a secure signing of the JWT signature for the JWT token such that your JWT token is much more secure and the signature can only be decoded using the client secret/certificate. It means your signature is private and can not be seen by others.
We provide the support for 2 Signing algorithms: HS256 and RS256.So, any of the signing algorithms can be chosen from the dropdown as shown in the above image.
Also, you need to add your client secret or certificate from which is used to sign the signature of the JWT.
7. Create User Specific API key/tokens
How to use this feature:
Mail us on oauthsupport@xecurify.com for quick guidance(via email/meeting) on your requirement and our team will help you to select the best suitable solution/plan as per your requirement.
Need Help? We are right here!
