Open baochungit opened 3 years ago
Met the same problem. There should be a way to support Basic Authentication, instead of letting jwt-auth
totally shadow it.
There is a workarround for this situation.
You can use the filter jwt_auth_authorization_header
to change the header key used for the plugin.
So, insted Authentication
you must setup something like JWTAuthentication
in .htaccess settings, as folllow:
RewriteEngine on
RewriteCond %{HTTP:JWTAuthorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_JWT_AUTHORIZATION:%1]
and in your custom wp plugin or functions:
add_filter( 'jwt_auth_authorization_header', function($headerkey){
return 'HTTP_JWT_AUTHORIZATION';
} );
@pesseba Just wanted to let you, and future people coming across this issue know, that this ONLY works from within a feature plugin, and does not change anything when used from the theme's functions.php.
I'm assuming it has to do with the order WordPress loads theme and plugin code?
@fabiangigler yes. Theme is loaded only in front-end requests. Rest API requests has no front-end dependency. So, you must add this filters in some plugin.
There is a workarround for this situation. You can use the filter
jwt_auth_authorization_header
to change the header key used for the plugin. So, instedAuthentication
you must setup something likeJWTAuthentication
in .htaccess settings, as folllow:RewriteEngine on RewriteCond %{HTTP:JWTAuthorization} ^(.*) RewriteRule ^(.*) - [E=HTTP_JWT_AUTHORIZATION:%1]
and in your custom wp plugin or functions:
add_filter( 'jwt_auth_authorization_header', function($headerkey){ return 'HTTP_JWT_AUTHORIZATION'; } );
this worked for me on an apache server that's stripping authorization headers. Just wanted to add that the format for sending the header is Jwt-Authorization: Bearer TOKENVALUE
, it took me a minute to figure out the naming convention.
When enabled, I see if the request header come with Basic Authorization (WC using it), the plugin throw an error
jwt_auth_bad_auth_header
. Could we make it no error so that other plugins can work with other authentications?Throwing
jwt_auth_no_auth_header
in this case is a good idea?