Category: CLI

Cookie-Nonce authentication for REST API cURL Requests

The WordPress REST API is quite a feature, but it can be a struggle to deal with authentication. One option is Basic Auth. But can we leverage the built-in cookie authentication?

If you look at rest_cookie_check_errors(), you’ll see where it’s checking for an authentication cookie and valid nonce. Using WP-CLI, we can carefully piece together a cURL command that passes those values appropriately. Remember, cookies and nonces have a limited lifetime, so be sure to generate new commands as time goes by.

Example

Run wp-cli command

$ wp curl-rest --user=admin

Output:

curl -H 'X-WP-NONCE: ooO0o00o00' --cookie \
  'wordpress_logged_in_wwWwwwWwwwWWwwwwwWwwwWWwwWWWwwwww=admin|xxxxxxxxxx|YYyyYyyyyYyYyYYYYYyyyYYyyyyYyyYYyyyyyyYYyyY|zZzzzzzZzZzzzzzZZzzzZzzzZzzZZzzzzzzZZzZzzzZZZzzZzZzzzZZzzzzzZzzz' \
  'http://local.wordpress.local/wp-json/wp/v2/settings'

Run curl command

$ curl -H 'X-WP-NONCE: ooO0o00o00' --cookie \
  'wordpress_logged_in_wwWwwwWwwwWWwwwwwWwwwWWwwWWWwwwww=admin|xxxxxxxxxx|YYyyYyyyyYyYyYYYYYyyyYYyyyyYyyYYyyyyyyYYyyY|zZzzzzzZzZzzzzzZZzzzZzzzZzzZZzzzzzzZZzZzzzZZZzzZzZzzzZZzzzzzZzzz' \
  'http://local.wordpress.local/wp-json/wp/v2/settings'

Output:
(prettified, I recommend the jq command line tool)

{
  "title": "wordpress.local",
  "description": "Just another WordPress site",
  "url": "http://local.wordpress.local",
  "email": "[email protected]",
  "timezone": "",
  "date_format": "F j, Y",
  "time_format": "g:i a",
  "start_of_week": 1,
  "language": "",
  "use_smilies": true,
  "default_category": 1,
  "default_post_format": "0",
  "posts_per_page": 10,
  "default_ping_status": "open",
  "default_comment_status": "open"
}

view raw

readme.md

hosted with ❤ by GitHub


<?php
if ( !defined( 'WP_CLI' ) ) return;
/**
*/
class trepmal_cURL_REST extends WP_CLI_Command {
/**
* Generate cURL command for REST API
*
* ## EXAMPLES
*
* # Generare command for fetching all administrators
* $ wp curl-rest –user=1 wp/v2/users?role=administrator
*
* @synopsis [<route>] –user=<user>
*
*/
function __invoke( $args, $assoc_args ) {
$args = wp_parse_args( [
0 => 'wp/v2/settings'
], $args );
list( $route ) = $args;
$route = trim( $route, '/');
if ( substr( $route, 0, 5 ) !== 'wp/v2' ) {
$route = "wp/v2/$route";
}
if ( ! $user_id = get_current_user_id() ) {
WP_CLI::error( 'Please pass –user' );
}
$expiration = time() + DAY_IN_SECONDS;
$manager = WP_Session_Tokens::get_instance( $user_id );
$token = $manager->create( $expiration );
$logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token );
$_COOKIE[ LOGGED_IN_COOKIE ] = $logged_in_cookie; // for nonce creation
$url = rest_url( $route );
$nonce = wp_create_nonce( 'wp_rest' );
$cookie = LOGGED_IN_COOKIE . "={$logged_in_cookie}";
$nonce_header = "X-WP-NONCE: $nonce";
$curl = "curl -H '$nonce_header' –cookie '$cookie' '$url'";
$split_curl = _split_str_by_whitespace( $curl, 100 );
$curl = implode( "\\\n ", $split_curl );
WP_CLI::line( $curl );
}
}
WP_CLI::add_command( 'curl-rest', 'trepmal_cURL_REST' );

view raw

curl-rest-cli.php

hosted with ❤ by GitHub

Command Line Shortcuts

Some command line shortcuts that might make your life easier. They’ve helped me, but sometimes I forget so I decided to group some of my favorites here.

To be specific, we’re talking bash. As a common default shell, there’s a good chance it’s what you’re using. So a lot of this can be found inside the bash manpage. If you’re using something else, I can’t say what of this might be compatible…

Event Designators

Ever need to repeat the last command? Easy, just use !!

$ echo some super-duper-annoy-to-retype command
some super-duper-annoy-to-retype command

$ !!
echo some super-duper-annoy-to-retype command
some super-duper-annoy-to-retype command

$ echo "!!" > what-was-that.txt
echo "echo some super-duper-annoy-to-retype command" > what-was-that.txt

$ cat what-was-that.txt
echo some super-duper-annoy-to-retype command

This is extremely handy if you meant to run the last command as sudo, just run sudo !!
Continue reading Command Line Shortcuts