apply_filters( ‘rest_authentication_errors’, WP_Error|null|true $errors )

User Contributed Notes

1. Skip to note 2 content

   Andrew 1 year ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 0You must log in to vote on the helpfulness of this note

   I needed to use this hook to fix a nonce expiration bug.

   My plugin uses the WP REST API to fetch data on the front-end. A longstanding issue has been that other caching plugins could sometimes cache this nonce, throwing a 403 error for my users.

   I used this solution:

   public function wpdocs_sanitize_nonce( $errors ) {
   
       // Bail if rest_route isn't defined (shouldn't happen!)
       if ( empty( $GLOBALS['wp']->query_vars['rest_route'] ) ) {
           return $errors;
       }
   
       $route = ltrim( $GLOBALS['wp']->query_vars['rest_route'], '/' );
   
       // Ensure we're dealing with our REST request only
       if ( strpos( $route, 'shopwp/v1' ) !== 0 ) {
           return $errors;
       }
   
       if ( ! empty( $_SERVER['HTTP_X_WP_NONCE'] ) ) {
           $nonce = $_SERVER['HTTP_X_WP_NONCE'];
   
           if ( ! wp_verify_nonce($nonce, 'wp_rest') ) {
               // Nonce check failed, so create a new one.
               $_SERVER['HTTP_X_WP_NONCE'] = wp_create_nonce( 'wp_rest' );
           }
       }
   
       return $errors;
   }