This plugin adds Basic Authentication to a WordPress site.
Note that this plugin requires sending your username and password with every request, and should only be used for development and testing. We strongly recommend using the OAuth 1.0a authentication handler for production.
- Download the plugin into your plugins directory
- Enable in the WordPress admin
This plugin adds support for Basic Authentication, as specified in RFC2617. Most HTTP clients will allow you to use this authentication natively. Some examples are listed below.
curl --user admin:password http://example.com/wp-json/
$args = array(
'headers' => array(
'Authorization' => 'Basic ' . base64_encode( $username . ':' . $password ),
),
);
A few notes on making this work on servers with php-cgi.
If you're using php-cgi you'll need to tweak the .htaccess file slightly. (more info about the issue: LearningLocker/learninglocker#131)
Change the Wordpress block in .htaccess in the root folder to:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
</IfModule>
# END WordPress
Then you'll want to stop Wordpress from overwriting this if you save permalinks.
Add this to your functions.php file: (You'll still be able to update your permalinks don't worry...)
// Stop WordPress from modifying .htaccess permalink rules
add_filter('flush_rewrite_rules_hard','__return_false');
Now we're able to get the right headers when running php-cgi, add this to your functions.php file:
What we're doing here is returning the result if they are logging in, or returning an error if they are not logged in.
// Check user is logged in before returning API results
add_filter('rest_pre_dispatch', function ($result) {
global $DI;
if (is_user_logged_in()) {
return $result;
} else {
return [
'error_code' => 'rest_requires_authentication',
'message' => 'Using REST requires authentication.',
'status' => '403'
];
}
});