JWT Authentication for WP REST API

About JWT Authentication for WP REST API

This plugin extends the WP REST API by allowing authentication using JSON Web Tokens (JWT). It requires the WP REST API V2 plugin to be installed and activated, as well as a minimum PHP version of 7.4.0. You can configure the secret key and enable CORS support in the plugin, and use the provided endpoints to authenticate users and validate tokens.

Frequently asked questions

What is JWT Authentication for WP REST API?

It is a WordPress plugin that extends the WP REST API by using JSON Web Tokens as an authentication method. JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

What are the requirements for using this plugin?

This plugin requires the WP REST API V2 plugin to be installed and activated. It also needs a minimum PHP version of 7.4.0 and for the PHP HTTP Authorization Header to be enabled.

How do I configure the secret key?

To configure the secret key, you need to edit your wp-config.php file and add a new constant called 'JWT_AUTH_SECRET_KEY'. You can use a string generated from api.wordpress.org/secret-key/1.1/salt/ for this.

How do I enable CORS support?

To enable CORS support, edit your wp-config.php file and add a new constant called 'JWT_AUTH_CORS_ENABLE' with the value 'true'.

Changelog

1.3.6

Added Safeguard in enqueue_plugin_assets to Handle Null or Empty $suffix

1.3.5

Notice: Add JWT Authentication Pro beta announcement notice.

1.3.4

Fix: Skip any type of validation when the authorization header is not Bearer.
Feature: Added a setting page to share data and add information about the plugin.

1.3.3

Update php-jwt to 6.4.0
Fix php warnings (https://github.com/Tmeister/wp-api-jwt-auth/pull/259)
Fix the condition where it checks if the request is a REST Request (https://github.com/Tmeister/wp-api-jwt-auth/pull/256)

1.3.2

Fix conflicts with other plugins using the same JWT library adding a wrapper namespace to the JWT class.

1.3.1

Updating the minimum version of PHP to 7.4
Validate the signing algorithm against the supported algorithms @see https://www.rfc-editor.org/rfc/rfc7518#section-3
Sanitize the REQUEST_URI and HTTP_AUTHORIZATION values before to use them
Use get_header() instead of $_SERVER to get the Authorization header when possible
Added typed properties to the JWT_Auth class where possible
Along with this release, I release a new simple JWT Client App for testing purposes @see https://github.com/Tmeister/jwt-client

1.3.0

Update firebase/php-jwt to 6.3
Fix warning, register_rest_route was called incorrectly
Allow for Basic Auth, by not attempting to validate Authentication Headers if a valid user has already been determined (see: https://github.com/Tmeister/wp-api-jwt-auth/issues/241)
Added a new filter (jwt_auth_algorithm) to allow for customizing the algorithm used for signing the token
Props: https://github.com/bradmkjr

1.2.6

Cookies && Token compatibility
Fix the root problem with gutenberg infinite loops and allow the token validation/generation if the WP cookie exists.
More info (https://github.com/Tmeister/wp-api-jwt-auth/pull/138)
Props: https://github.com/andrzejpiotrowski

1.2.5

Add Gutenberg Compatibility
More info (https://github.com/Tmeister/wp-api-jwt-auth/issues/126)

1.2.4

Update firebase/php-jwt to v5.0.0 ( https://github.com/firebase/php-jwt )
Add Requires PHP Tag

1.2.3

Fix Max recursion error in WordPress 4.7 #44

1.2.2

Add an extra validation to get the Authorization header
Increase determine_current_user priority Fix #13
Add the user object as parameter in the jwt_auth_token_before_sign hook
Improve error message when auth fails #34
Tested with 4.6.1

1.2.0

Tested with 4.4.2

1.0.0

Initial Release.