{"id":75214,"date":"2017-09-26T09:57:53","date_gmt":"2017-09-26T09:57:53","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/disable-rest-api-and-require-jwt-oauth-authentication\/"},"modified":"2017-09-26T09:57:53","modified_gmt":"2017-09-26T09:57:53","slug":"disable-rest-api-and-require-jwt-oauth-authentication","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/disable-rest-api-and-require-jwt-oauth-authentication\/","author":8197245,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0","stable_tag":"1.0","tested":"4.8.28","requires":"4.4","requires_php":"5.2","requires_plugins":"","header_name":"Disable REST API and Require JWT \/ OAuth Authentication","header_author":"Benjamin Intal, Gambit Technologies, Inc.","header_description":"Blocks all REST API endpoints and requires JWT or OAuth Authentication.","assets_banners_color":"4376d5","last_updated":"2017-09-26 09:57:53","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/www.paypal.com\/cgi-bin\/webscr?cmd=_s-xclick&hosted_button_id=5A97UAY68JHY4","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/disable-rest-api-and-require-jwt-oauth-authentication\/","header_author_uri":"http:\/\/gambit.ph","rating":0,"author_block_rating":0,"active_installs":60,"downloads":9980,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":[],"upgrade_notice":{"":"<p>None.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":0},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":"1736141","resolution":"128x128","location":"assets"},"icon-256x256.png":{"filename":"icon-256x256.png","revision":"1736141","resolution":"256x256","location":"assets"}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":"1736141","resolution":"1544x500","location":"assets"},"banner-772x250.png":{"filename":"banner-772x250.png","revision":"1736141","resolution":"772x250","location":"assets"}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":"1736141","resolution":"1","location":"assets"},"screenshot-2.jpg":{"filename":"screenshot-2.jpg","revision":"1736141","resolution":"2","location":"assets"}},"screenshots":{"1":"Blocked REST API requests","2":"Authenticated REST API requests are allowed"},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[1556,1118,2299,23853,867],"plugin_category":[],"plugin_contributors":[79460,80306],"plugin_business_model":[],"class_list":["post-75214","plugin","type-plugin","status-publish","hentry","plugin_tags-api","plugin_tags-json","plugin_tags-rest","plugin_tags-rest-api","plugin_tags-web","plugin_contributors-bfintal","plugin_contributors-gambitph","plugin_committers-bfintal"],"banners":{"banner":"https:\/\/ps.w.org\/disable-rest-api-and-require-jwt-oauth-authentication\/assets\/banner-772x250.png?rev=1736141","banner_2x":"https:\/\/ps.w.org\/disable-rest-api-and-require-jwt-oauth-authentication\/assets\/banner-1544x500.png?rev=1736141","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/disable-rest-api-and-require-jwt-oauth-authentication\/assets\/icon-128x128.png?rev=1736141","icon_2x":"https:\/\/ps.w.org\/disable-rest-api-and-require-jwt-oauth-authentication\/assets\/icon-256x256.png?rev=1736141","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/disable-rest-api-and-require-jwt-oauth-authentication\/assets\/screenshot-1.jpg?rev=1736141","caption":"Blocked REST API requests"},{"src":"https:\/\/ps.w.org\/disable-rest-api-and-require-jwt-oauth-authentication\/assets\/screenshot-2.jpg?rev=1736141","caption":"Authenticated REST API requests are allowed"}],"raw_content":"<!--section=description-->\n<p><strong>When you activate this plugin, all REST API endpoints will be disabled for non-authorized requests.<\/strong><\/p>\n\n<p>Best used with any of these plugins:<\/p>\n\n<ul>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/jwt-authentication-for-wp-rest-api\/\">JWT Authentication for WP REST API<\/a><\/li>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/oauth2-provider\/\">WP OAuth Server<\/a><\/li>\n<\/ul>\n\n<p>Blocks <em>ALL<\/em> REST API endpoints except for:<\/p>\n\n<ul>\n<li>\/jwt-auth\/v1\/token\/validate<\/li>\n<li>\/jwt-auth\/v1\/token<\/li>\n<li>\/oauth\/authorize<\/li>\n<li>\/oauth\/token<\/li>\n<li>\/oauth\/me<\/li>\n<\/ul>\n\n<p>Allows all REST API endpoints if they come with a valid <strong>Bearer Token Authentication<\/strong> (authentication via GET URL variables are still blocked)<\/p>\n\n<p>When used alone in your site, your REST API will essentially be disabled.<\/p>\n\n<blockquote>\n  <p>Note that this plugin itself doesn't provide JWT or OAuth authentication, it only whitelists them.<\/p>\n<\/blockquote>\n\n<h4>Features<\/h4>\n\n<ul>\n<li>No settings page<\/li>\n<li>You can whitelist other REST API endpoint via a filter hook (see FAQs below)<\/li>\n<li>Blocks all REST API endpoints.. but<\/li>\n<li>Allows requests with Bearer Token Authentication.. and<\/li>\n<li>Allows <a href=\"https:\/\/wordpress.org\/plugins\/jwt-authentication-for-wp-rest-api\/\">JWT Authentication for WP REST API<\/a> &amp; <a href=\"https:\/\/wordpress.org\/plugins\/oauth2-provider\/\">WP OAuth Server<\/a> authentication endpoints<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Head over to Plugins &gt; Add New in the admin<\/li>\n<li>Search for \"Disable REST API and Require Authentication\"<\/li>\n<li>Install &amp; activate the plugin<\/li>\n<li>Now your REST API endpoints are disabled for non-authenticated requests.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt>Installation Instructions<\/dt>\n<dd><ol>\n<li>Head over to Plugins &gt; Add New in the admin<\/li>\n<li>Search for \"Disable REST API and Require Authentication\"<\/li>\n<li>Install &amp; activate the plugin<\/li>\n<li>Now your REST API endpoints are disabled for non-authenticated requests.<\/li>\n<\/ol><\/dd>\n<dt>How is this different from Disable REST API?<\/dt>\n<dd><p>This plugin is similar to Disable REST API, wherein it disables all REST API endpoints, <em>but it<\/em> still allows the authentication endpoints provided by:<\/p>\n\n<ul>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/jwt-authentication-for-wp-rest-api\/\">JWT Authentication for WP REST API<\/a><\/li>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/oauth2-provider\/\">WP OAuth Server<\/a><\/li>\n<\/ul>\n\n<p>And if a <strong>Bearer Token Authentication<\/strong> is provided, then the REST API becomes available.<\/p><\/dd>\n<dt>How can I check if my REST API is disabled?<\/dt>\n<dd><p>Open a new incognito browser tab or private browser tab and visit your <code>wp-json<\/code> URL:<\/p>\n\n<blockquote>\n  <p><code>http:\/\/mysite\/wp-json\/<\/code><\/p>\n<\/blockquote>\n\n<p>You will see this message:<\/p>\n\n<blockquote>\n  <p><code>{\"code\":\"rest_not_logged_in\",\"message\":\"You are not currently logged in.\",\"data\":{\"status\":401}}<\/code><\/p>\n<\/blockquote><\/dd>\n<dt>What is a Bearer Token Authenticated REST API request?<\/dt>\n<dd><p>A Bearer Token Authenticated REST API request is a REST API call with this <strong>header<\/strong>:<\/p>\n\n<blockquote>\n  <p>Authorization: Bearer XXXXXXX<\/p>\n<\/blockquote>\n\n<p>The <em>XXXXXXX<\/em> corresponds to the authentication token given by any of these 2 plugins:<\/p>\n\n<ul>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/jwt-authentication-for-wp-rest-api\/\">JWT Authentication for WP REST API<\/a><\/li>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/oauth2-provider\/\">WP OAuth Server<\/a><\/li>\n<\/ul><\/dd>\n<dt>How do I implement JWT \/ OAuth authentication?<\/dt>\n<dd><p>That is outside the scope of this plugin, please refer to the docs of the respective plugins:<\/p>\n\n<ul>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/jwt-authentication-for-wp-rest-api\/\">JWT Authentication for WP REST API<\/a><\/li>\n<li><a href=\"https:\/\/wordpress.org\/plugins\/oauth2-provider\/\">WP OAuth Server<\/a><\/li>\n<\/ul><\/dd>\n<dt>How do I whitelist other REST API endpoints? (via filter hook)<\/dt>\n<dd><p>I've placed a filter called <code>reqauth\/allowed_endpoints<\/code> where you can add your own REST API endpoints to the whitelist.<\/p>\n\n<p>For example, I want to allow <code>\/my-endpoint<\/code> for non-authorized REST API calls:<\/p>\n\n<pre><code>add_filter( 'reqauth\/allowed_endpoints', 'allow_my_endpoints' );\nfunction( $allowed_endpoints ) {\n    $allowed_endpoints[] = '\/my-endpoint';\n    return $allowed_endpoints;\n}\n<\/code><\/pre><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>v1.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<\/ul>","raw_excerpt":"Disables all REST API endpoints and requires JWT or OAuth Authentication.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/75214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=75214"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/bfintal"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=75214"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=75214"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=75214"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=75214"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=75214"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=75214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}