Restrict and control access to the REST API.

Sean Fisher

<p>Restrict and control access to the REST API.</p>
<h3>Usage</h3>
<p>The WordPress REST API is generally very public and can share a good deal of information with the internet anonymously. This plugin aims to make it easier to restrict access to the REST API for your WordPress site.</p>
<p>Out of the box the plugin can:</p>
<ul>
<li>Disable anonymous access to the REST API.</li>
<li>Restrict and control anonymous access to the REST API by namespace, path, etc.</li>
</ul>
<h3>Settings Page</h3>
<p>The plugin can be configured via the Settings page (<code>Settings -> REST API Guard</code>) or via the relevant filter.</p>
</p>
<h3>Preventing Access to User Information (<code>wp/v2/users</code>)</h3>
<p>By default, the plugin will restrict anonymous access to the users endpoint. This can be prevented in the plugin’s settings or via code:</p>
<pre><code>add_filter( 'rest_api_guard_allow_user_access', fn () => true );
</code></pre>
<h3>Preventing Access to Index (<code>/</code>) or Namespace Endpoints (<code>wp/v2</code>)</h3>
<p>To prevent anonymous users from browsing your site and discovering what plugins/post types are setup, the plugin restricts access to the index (<code>/</code>) and namespace (<code>wp/v2</code>) endpoints. This can be prevented in the plugin’s settings or via code:</p>
<pre><code>// Allow index access.
add_filter( 'rest_api_guard_allow_index_access', fn () => true );

// Allow namespace access.
add_filter( 'rest_api_guard_allow_namespace_access', fn ( string $namespace ) => true );
</code></pre>
<h3>Restrict Anonymous Access to the REST API</h3>
<p>The plugin can restrict anonymous access for any request to the REST API in the plugin’s settings or via code:</p>
<pre><code>add_filter( 'rest_api_guard_prevent_anonymous_access', fn () => true );
</code></pre>
<h3>Limit Anonymous Access to Specific Namespaces/Routes (Allowlist)</h3>
<p>Anonymous users can be granted access only to specific namespaces/routes. Requests outside of these paths will be denied. This can be configured in the plugin’s settings or via code:</p>
<pre><code>add_filter(
    'rest_api_guard_anonymous_requests_allowlist',
    function ( array $paths, WP_REST_Request $request ): array {
        // Allow other paths not included here will be denied.
        $paths[] = 'wp/v2/post';
        $paths[] = 'custom-namespace/v1/public/*';

        return $paths;
    },
    10,
    2
);
</code></pre>
<h3>Restrict Anonymous Access to Specific Namespaces/Routes (Denylist)</h3>
<p>Anonymous users can be restricted from specific namespaces/routes. This acts as<br />
a denylist for specific paths that an anonymous user cannot access. The paths<br />
support regular expressions for matching. The use of the allowlist takes<br />
priority over this denylist. This can be configured in the plugin’s settings or<br />
via code:</p>
<pre><code>add_filter(
    'rest_api_guard_anonymous_requests_denylist',
    function ( array $paths, WP_REST_Request $request ): array {
        $paths[] = 'wp/v2/user';
        $paths[] = 'custom-namespace/v1/private/*';

        return $paths;
    },
    10,
    2
);
</code></pre>
<h3>Require JSON Web Token (JWT) Authentication</h3>
<p>Anonymous users can be required to authenticate via a JSON Web Token (JWT) to<br />
access the REST API. Users should pass an <code>Authorization: Bearer <token></code> header<br />
with their request. This can be configured in the plugin’s settings or via code:</p>
<pre><code>add_filter( 'rest_api_guard_authentication_jwt', fn () => true );
</code></pre>
<p>Out of the box, the plugin will look for a JWT in the <code>Authorization: Bearer<br />
<token></code> header. The JWT will be expected to have an audience of<br />
‘wordpress-rest-api’ and issuer of the site’s URL. This can be configured in the<br />
plugin’s settings or via code:</p>
<pre><code>add_filter(
    'rest_api_guard_jwt_audience',
    function ( string $audience ): string {
        return 'custom-audience';
    }
);

add_filter(
    'rest_api_guard_jwt_issuer',
    function ( string $issuer ): string {
        return 'https://example.com';
    }
);
</code></pre>
<p>The JWT’s secret will be autogenerated and stored in the database in the<br />
    rest_api_guard_jwt_secret option. The secret can also be changed via code:</p>
<pre><code>add_filter(
    'rest_api_guard_jwt_secret',
    function ( string $secret ): string {
        return 'my-custom-secret';
    }
);
</code></pre>
<h3>Allow JWT Authentication for Authenticated Users</h3>
<p>Authenticated users can be authenticated with the REST API via a JSON Web Token.<br />
Similar to the anonymous JWT authentication, users should pass an<br />
    Authorization: Bearer  header with their request. This can be<br />
configured in the plugin’s settings or via code:</p>
<pre><code>add_filter( 'rest_api_guard_user_authentication_jwt', fn () => true );
</code></pre>
<h3>Generating JWTs for Anonymous and Authenticated Users</h3>
<p>JWTs can be generated by calling the<br />
    wp rest-api-guard generate-jwt [–user=] command or using the<br />
    Alley\WP\REST_API_Guard\generate_jwt() method:</p>
<pre><code>$jwt = \Alley\WP\REST_API_Guard\generate_jwt(
    expiration: 3600, // Optional. The expiration time in seconds from now.
    user: 1, // Optional. The user ID to generate the JWT for. Supports `WP_User` or user ID.
);
</code></pre>


REST API Guard

Simple and effective. I love being able to easily turn off access to the REST API.

Alternatives to REST API Guard

Top alternatives