wp_get_current_user() function not working in Rest API callback function

Consider the following class.

?php
class MCQAcademy_Endpoint extends WP_REST_Controller {

    /**
     * Register the routes for the objects of the controller.
     */
    public function register_routes() {
        $version = '1';
        $namespace = 'custompath/v' . $version;
        $base = 'endpointbase';

        register_rest_route(
            $namespace,
            '/' . $base,
            array(
                array(
                    'methods'         = WP_REST_Server::READABLE,
                    'callback'        = array( $this, 'get_items' ),
                    'permission_callback' = array( $this, 'get_items_permissions_check' ),
                    'args'            = array(),
                )
            )
        );
    }

    /**
     *
     */
    public function get_items( $request ) {
        $rs = array(
            'data' = array(),
            'request' = array(
                'lang' = 'en',
            ),
        );

        $args = array();
        $items = get_posts( $args );

        foreach( $items as $item ) {
            $itemdata = $this-prepare_item_for_response( $item, $request );
            $rs['data'][] = $this-prepare_response_for_collection( $itemdata );
        }

        $rs['wp_get_current_user'] = wp_get_current_user(); // Does not output as expected

        return new WP_REST_Response( $rs, 200 );
    }

    /**
     * Check if a given request has access to get items
     */
    public function get_items_permissions_check( $request ) {
        return true; // to make readable by all
    }


    /**
     * Prepare the item for create or update operation
     */
    protected function prepare_item_for_database( $request ) {
        return $request;
    }

    /**
     * Prepare the item for the REST response
     */
    public function prepare_item_for_response( $item, $request ) {
        $data = array(
            'ID' = $item-ID,
            'post_content' = wpautop($item-post_content),
            'post_title' = $item-post_title,
        );

        return $data;
    }

    /**
     * Get the query params for collections
     */
    public function get_collection_params() {
        return array(
            'page'     = array(
                'description'        = 'Current page of the collection.',
                'type'               = 'integer',
                'default'            = 1,
                'sanitize_callback'  = 'absint',
            ),
            'per_page' = array(
                'description'        = 'Maximum number of items to be returned in result set.',
                'type'               = 'integer',
                'default'            = 10,
                'sanitize_callback'  = 'absint',
            ),
            'search'   = array(
                'description'        = 'Limit results to those matching a string.',
                'type'               = 'string',
                'sanitize_callback'  = 'sanitize_text_field',
            ),
        );
    }

    // Register our REST Server
    public function hook_rest_server(){
        add_action( 'rest_api_init', array( $this, 'register_routes' ) );
    }
}

$myEndpoint = new MCQAcademy_Endpoint();
$myEndpoint-hook_rest_server();

Everything is going well except calling the wp_get_current_user() function in the get_items() function return empty user even though the user is logged in in the website.

Topic rest-api Wordpress

Category Web

1
answered at

Logged in on your website doesn't mean the user is authenticated in the REST API request, that's why you are not getting the correct user or a Id = 0

Please take a look to the REST API authentication methods on the docs:
https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/

For developers making manual Ajax requests, the nonce will need to be passed with each request. The API uses nonces with the action set to wp_rest. These can then be passed to the API via the _wpnonce data parameter (either POST data or in the query for GET requests), or via the X-WP-Nonce header. If no nonce is provided the API will set the current user to 0, turning the request into an unauthenticated request, even if you’re logged into WordPress.

For remote authentication I'd recommend the JWT plugin for a quick start:

Or you can use the ones suggested on the docs:

1
answered at

If an API call comes in that does not have a nonce set, WordPress will de-authenticate the request, killing the current user and making the request unauthenticated. This CSFR protection is automatic, and you don't have to do anything for it to work other than include the nonce.

The way to solve this is to include a nonce. Something like this:

$_wpnonce = wp_create_nonce( 'wp_rest' );
echo "<input type = 'hidden' name = '_wpnonce' value = '$_wpnonce' />";

And include it in your API request. The nonce must be called "_wpnonce" and the action must be "wp_rest" for the API to work. It can go in the URL or in the post body.

1
answered at

wp_get_current_user() does not work because your user is not set perfectly. See below code in /wp-includes/user.php for reference.

if ( ! empty( $current_user ) ) {
    if ( $current_user instanceof WP_User ) {
        return $current_user;
    }

    // Upgrade stdClass to WP_User
    if ( is_object( $current_user ) && isset( $current_user->ID ) ) {
        $cur_id       = $current_user->ID;
        $current_user = null;
        wp_set_current_user( $cur_id );
        return $current_user;
    }

    // $current_user has a junk value. Force to WP_User with ID 0.
    $current_user = null;
    wp_set_current_user( 0 );
    return $current_user;
}

if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) {
    wp_set_current_user( 0 );
    return $current_user;
}

All you need to do is wp_set_current_user( {user_id} ) at the start of your API.

1
answered at

To have a fully working code sample here comes a sample plugin on how to retrieve the current user's ID via REST.

my-plugin.php

class MyPlugin {

  public function __construct() {

    add_action('wp_enqueue_scripts', [$this, 'scripts']);
    add_action('rest_api_init', [$this, 'rest']);
  }

  function scripts() {

    // Add JS.
    wp_enqueue_script('my-plugin', plugin_dir_url(__FILE__) . 'js/scripts.js', ['jquery'], NULL, TRUE);
    // Pass nonce to JS.
    wp_localize_script('my-plugin', 'MyPluginSettings', [
      'nonce' => wp_create_nonce('wp_rest'),
    ]);
  }

  function rest() {

    // Register route.
    register_rest_route('my-plugin/v1', '/uid', [
      'methods'  => WP_REST_Server::READABLE,
      'callback' => [$this, 'rest_callback'],
    ]);
  }

  function rest_callback($data) {

    // Get current user ID.
    $data = [
      'uid' => get_current_user_id(),
    ];

    $response = new WP_REST_Response($data, 200);
    // Set headers.
    $response->set_headers(['Cache-Control' => 'must-revalidate, no-cache, no-store, private']);

    return $response;
  }

}

new MyPlugin();

js/scripts.js

(function($) {

  $(document).ready(function() {

    var settings = MyPluginSettings;

    $.ajax({
      url: '/wp-json/my-plugin/v1/uid',
      method: 'GET',
      beforeSend: function(xhr) {
        xhr.setRequestHeader('X-WP-Nonce', settings.nonce);
      }
    }).done(function(response) {

      // Will return your UID.
      console.log(response);
    });

  });

})(jQuery);

Resource: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/

About

Geeks Mental is a community that publishes articles and tutorials about Web, Android, Data Science, new techniques and Linux security.