search

Tmeister / wp-api-jwt-auth

A simple plugin to add JSON Web Token (JWT) Authentication to WP REST API
GNU General Public License v2.0
546 stars 160 forks source link

JWT Token / Auth Cookie add SameSite attribute and Secure flag to cookie. #299

Open webgurus opened 4 months ago

webgurus commented 4 months ago

Hello,

I have an issue that I'm blocked by, the JWT auth token generation uses the wp_authenticate for logging in the user. The problem with this is that I'm trying to use the WP Site in an iframe on another platform and the JWT cookie that is required for subsequent API calls (using Authentication: Bearer ) is failing. It gives a 401 error on the api endpoints.

Based on some research, the cookies need to have SameSite:none and Secure: true attributes for this to work, but I'm not sure how and where to set these on the Token Cookie.

Can you point me in the right direction on how to allow this to work in an IFRAME?

Thanks, Marton