Requests blocked because of UserAgent

[ghost]

I kept getting 403 responses from our web server whenever I tried a request. Eventually I discovered that this was because there was no UserAgent header set, and our server is configured to block certain UserAgents. I think this is part of the iThemes Security plugin we have installed.

Since I'm not too familiar with configuring .htaccess rules, I found a workaround by modifying the WordPressPCL package so that I could set the UserAgent header in my main program. After setting this to the Chrome UserAgent string, it seems to be working now.

It might be a useful feature to be able to modify the request headers using the WordPressClient class.

[ThomasPe]

Hey, that would be a nice feature to have indeed. I'll gladly take a look at any Pull Requests :)

[ThomasPe]

I've updated the wiki to show how this could be achieved by injecting a custom HttpClient instance. Would this work for you @svanbo? https://github.com/wp-net/WordPressPCL/wiki/HttpClient-Injection

[richardaubin]

wiki link above is not going to right place.

I'm having a similar issue where I can get the response using postman, but using my own app with wordpresspcl and the same credentials, I cannot get passed the security.

[ThomasPe]

have you tried this? https://wp-net.github.io/WordPressPCL/I%20version%202.x/customization/customHttpClient/

[richardaubin]

Yeah, I tried it using a custom user-agent, your example, and a chrome one.

Still no luck.

[richardaubin]

And I'm sure it's wordpresspcl because the next check in my pipeline uses WooCommerceNet and the keys from there are working.

[richardaubin]

Wow, problem resolved and this is how I fixed it: useAuth = true:

I remembered I had the same issue last year: https://github.com/wp-net/WordPressPCL/issues/326

There's no mention anywhere in the documentation that useAuth needs to be set to true when using authentication. I just dug into the httphelper class after noticing the get method I was using had an optional parameter: useAuth.

So now I have to go everywhere in my code I'm using this and add a true value, because I developed up till this point on a local server without any authentication requirements.

So my question is, should it default to using authentication, when we are forcing it when initializing the client?

[ThomasPe]

I just checked - generally it's not necessary to have the auth flag set even when using auth, so I assume this is an issue specific to your WordPress installation.

However I'm always happy with contributions to the docs which certainly are lacking.

[richardaubin]

I'll gladly add an entry to the docs in regards to the using the cilent on a site enabled with IThemes Security Pro.