Tips for securely implementing JSON web tokens when integrating an external application with the WordPress REST API

Question

Tips for securely implementing JSON web tokens when integrating an external application with the WordPress REST API

I have a query regarding JWT. Let's consider this situation.

A -> wordpress site with wp rest api enabled;
B -> External application (for example, a simple javascript/jQuery app)

Suppose I want to make a post request or create a new post on the wordpress website (A). I can do so by entering a username and password, then receiving a JWT token for authentication. If I set up a quick login feature, it would work without exposing the username and password. However, here lies the issue: What if I require the application to retrieve all the posts from A (wordpress website through rest api), but I don't want a login feature? Essentially, I need a method to input user login credentials to obtain a jwt token, but it seems illogical since someone could simply inspect the js code and extract that information?

javascript json ajax wordpress jwt

Answer 1

Answer №1

In order to create a jwt, the code follows this format. It's important to note that the email and name are treated as one-time variables in the javascript file, while the username and email themselves aren't directly included in the code.

userSchema.methods.generateJwt = function() {
  var expiry = new Date();
  expiry.setDate(expiry.getDate() + 7);

  return jwt.sign(
    {
      _id: this._id,
      email: this.email,
      name: this.name,
      exp: parseInt(expiry.getTime() / 1000)
    },
    jwt_secret
  );
};

The only potential risk is accidentally revealing the jwt_secret. To prevent this, it's advised to store the secret securely within a dotenv file and avoid including it in version control.

require("dotenv").config();
const jwt_secret = process.env.JWT_SECRET;

Answer 2

In order to create a jwt, the code follows this format. It's important to note that the email and name are treated as one-time variables in the javascript file, while the username and email themselves aren't directly included in the code.

userSchema.methods.generateJwt = function() {
  var expiry = new Date();
  expiry.setDate(expiry.getDate() + 7);

  return jwt.sign(
    {
      _id: this._id,
      email: this.email,
      name: this.name,
      exp: parseInt(expiry.getTime() / 1000)
    },
    jwt_secret
  );
};

The only potential risk is accidentally revealing the jwt_secret. To prevent this, it's advised to store the secret securely within a dotenv file and avoid including it in version control.

require("dotenv").config();
const jwt_secret = process.env.JWT_SECRET;

Tips for securely implementing JSON web tokens when integrating an external application with the WordPress REST API

Answer №1

Similar questions

Sharing styles between ReactJS and Material-UI - best practices

What causes the submit button to trigger an Ajax request?

What is the best way to organize my data so that it can be properly formatted and encoded as JSON?

Is there a way to trigger a function for both a left and middle click at the same time?

lengthy conditional statement in JavaScript

Data is not appearing as expected in the React component when using the data

An issue arose during the page prerendering process for "/" on Vercel | Next.js resulting in a deployment error

I'm trying to locate the ID of a widget already present in WordPress. This is necessary so I can trigger a specific function only when that widget is visible on the front end

The success function within the Ajax code is malfunctioning

Struggling to run the CommandLineRunner in springboot. I am encountering issues with reading JSON data using the following code. Any suggestions on

The headline box is displaying CSS code instead of the content. How can this issue be resolved?

Facing issue with Codeigniter AJAX form where post data is not being collected

Ways to conceal a component based on a specific condition?

What are the reasons for the failure of the AJAX call?

Setting headers in Node.js after they have already been sent to the client is not allowed

Employing ajax verification to ensure that the email address does not already exist prior to the main POST request (ASP.NET MVC4)

transform data into JSON format and transmit using jquery ajax

The form data is being submitted multiple times by Ajax

Parsley JS: A Solution for Distinct IDs

Activating gzip compression using fetch.js