permission_callback has no effect

WP version is 5.5.3

I have 3 API routes set in a plugin that is used in an admin dashboard page. One route is meant to be used publicly.

I have two very curious issues happening:

  1. My 3 admin-centric routes do not specify permission_callback. I should be getting notices but I do not when the docs and WP core functions say it will throw a doing_it_wrong error.
  2. My 4th public route does have 'permission_callback' = '__return_true' set. I receive a rest_not_logged_in error code.
class My_Plugin
{
    public function __construct()
    {
        add_action( 'rest_api_init', [ $this, 'register_routes' ] );
    }
    
    public function register_routes(): void
    {
        register_rest_route('my-api-route', '/uri', [
            'methods' = WP_REST_Server::READABLE,
            'callback' = [$this, 'api_get_available_stuff'],
        ]);

        register_rest_route('my-api-route', /uri/(?Pparam[a-zA-Z0-9-]+), [
            'methods' = WP_REST_Server::READABLE,
            'callback' = [$this, 'api_get_specific_stuff'],
        ]);

        register_rest_route('my-api-route', /uri/(?Pparam[0-9-]+), [
            'methods' = WP_REST_Server::EDITABLE,
            'callback' = [$this, 'api_update_specific_stuff'],
        ]);

        register_rest_route('my-api-route', /uri/(?Pparam[a-zA-Z0-9-]+)/load-more, [
            'methods' = WP_REST_Server::READABLE,
            'callback' = [$this, 'api_load_more_stuff'],
            'permission_callback' = '__return_true',
        ]);
    }
}
// header approach
$.ajax({
  url: '/wp-json/my-api-route/uri/param/load-more',
  method: 'GET',
  headers: {
    'X-WP-Nonce': '?php echo wp_create_nonce('wp_rest'); ?'
  },
  data: {
    'max_items': 5,
    'offset': 5 * current_count,
  },
})

// _wpnonce approach
$.ajax({
  url: '/wp-json/my-api-route/uri/param/load-more',
  method: 'GET',
  data: {
    '_wpnonce': '?php echo wp_create_nonce('wp_rest'); ?',
    'max_items': 5,
    'offset': 5 * current_count,
  },
})

My only conclusion could be that, despite seeing Version 5.5.3 in the bottom corner of WP Admin, I might not actually be on 5.5.3.

Topic nonce rest-api permissions Wordpress

Category Web


Are you sure that a _doing_it_wrong notice isn't being issued? You won't see the notice visibly output on the page because that would break the JSON response. But if you look in the headers of the response you should see a X-WP-DoingItWrong header.

It should also appear if you use a plugin like this to record developer notices: https://wordpress.org/plugins/log-deprecated-notices/

About

Geeks Mental is a community that publishes articles and tutorials about Web, Android, Data Science, new techniques and Linux security.