Wordpress REST API Auth Application Password Nonce Cookie

Definisi

WP REST API punya 3 cara auth: Cookie + nonce (request dari halaman WP sendiri, butuh X-WP-Nonce), Application Password (user generate di profile, Basic Auth via HTTPS), dan JWT/OAuth (plugin pihak ketiga). Tanpa auth, endpoint mutasi (POST/PUT) ditolak.

Kapan dipakai

Pakai Application Password untuk integrasi eksternal (mobile/app) via HTTPS. Pakai nonce+cookie untuk AJAX di dalam admin/front-end WP. Jangan pakai Basic Auth tanpa HTTPS (bocor).

Cara kerja

Application Password

bash

# header tiap request
curl -u "user:XXXX XXXX XXXX XXXX XXXX" https://site/wp-json/wp/v2/posts
# (Basic Auth over HTTPS)

Nonce (JS di WP)

js

fetch('/wp-json/wp/v2/posts', {
  method: 'POST',
  headers: { 'X-WP-Nonce': wpApiSettings.nonce, 'Content-Type': 'application/json' },
  body: JSON.stringify({ title: 'Baru' })
});

Struktur alur

Catatan implementasi

• Application Password hanya jalan di HTTPS; WP menolak di HTTP polos (kecuali localhost).
• Nonce terikat session login; regenerate saat logout/login.
• Permission callback di register_rest_route tetap wajib memeriksa capability.
• Jangan hardcode credential; baca dari env (lihat file 188).

Kesalahan umum

• Basic Auth tanpa HTTPS: bocor; selalu TLS.
• Lupa permission_callback: endpoint terbuka; selalu cek current_user_can.
• Nonce expired: regenerate; jangan cache statis.
• App Password di HTTP: WP blokir; pakai localhost atau HTTPS.

Referensi terkait

• WordPress REST Register Field, Extend Response, Permission
• WordPress Application Passwords, REST Auth, Basic Auth + TLS
• PHP Environment & dotenv: Config per Environment, Keamanan