andrewheberle

<p>This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header that is added by a reverse proxy<br />
that sits in front of your WordPress deployment.</p>
<p>Authentication and optionally role assignment is handled by claims contained in the JWT.</p>
<p>Verification of the JWT is handled by either:</p>
<ul>
<li>a shared secret key</li>
<li>retrieving a JSON Web Key Set (JWKS) from a configured URL</li>
</ul>
<p>During the login process if the user does not exist an account will be created with a matching role from the JWT.</p>
<p>If the JWT did not contain a role claim then user is created with the role set in the plugin settings (by default this is the subscriber role).</p>


AH JWT Auth

This plugin allows sign in to WordPress using a JSON Web Token (JWT) contained in a HTTP Header.

Sayan Dey

<p>Extends the WordPress REST API using JSON Web Tokens for robust authentication and authorization.</p>
<p>JSON Web Token (JWT) is an open standard (<a href="https://tools.ietf.org/html/rfc7519" rel="nofollow ugc">RFC 7519</a>) that defines a compact and self-contained way for securely transmitting information between two parties.</p>
<p>It provides a secure and reliable way to access and manage WordPress data from external applications, making it ideal for building headless CMS solutions.</p>
<ul>
<li>Support & question: <a href="https://wordpress.org/support/plugin/simple-jwt-auth/" rel="ugc">WordPress support forum</a></li>
<li>Reporting plugin’s bug: <a href="https://github.com/sayandey18/simple-jwt-auth/issues" rel="nofollow ugc">GitHub issues tracker</a></li>
</ul>
<p><strong>Plugins GitHub Repo</strong> https://github.com/sayandey18/simple-jwt-auth</p>
<h3>Enable PHP HTTP Authorization Header</h3>
<p>HTTP Authorization is a mechanism that allows clients to provide credentials to servers, thereby gaining access to protected resources. This is typically achieved by sending a special header, the Authorization header, in the HTTP request.</p>
<h4>Shared Hosts</h4>
<p>Most shared hosts have disabled the <strong>HTTP Authorization Header</strong> by default.</p>
<p>To enable this option you’ll need to edit your <strong>.htaccess</strong> file by adding the following:</p>
<pre><code>RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</code></pre>
<h4>WPEngine</h4>
<p>To enable this option you’ll need to edit your .htaccess file adding the follow:</p>
<pre><code>SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</code></pre>
<h3>Configuration</h3>
<p>Simple JWT Auth plugin needs a <strong>Signing Key</strong> to encrypt and decrypt the <strong>secret key</strong>, <strong>private key</strong>, and <strong>public key</strong>. This signing key must be exact 32 charecter long and never be revealed.</p>
<p>To add the <strong>signing key</strong> edit your <code>wp-config.php</code> file and add a new constant called <strong>SIMPLE_JWT_AUTH_ENCRYPT_KEY</strong></p>
<pre><code>define( 'SIMPLE_JWT_AUTH_ENCRYPT_KEY', 'your-32-char-signing-key' );
</code></pre>
<p>Generate a 32 charecter key from here: <a href="https://string-gen.netlify.app" rel="nofollow ugc">https://string-gen.netlify.app</a></p>
<p>Here is the sample response if the encryption key is not configured in wp-config.php file.</p>
<pre><code>{
    "code": "simplejwt_bad_encryption_key",
    "message": "Encryption key is not configured properly.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h3>REST Endpoints</h3>
<p>When the plugin is activated, a new namespace is added.</p>
<pre><code>/auth/v1
</code></pre>
<p>Also, two new endpoints are added to this namespace.</p>
<pre><code>*/wp-json/auth/v1/token          | POST
*/wp-json/auth/v1/token/validate | POST
</code></pre>
<h3>Requesting/Generating Token</h3>
<p>To generate a new token, submit a POST request to this endpoint. With <code>username</code> and <code>password</code> as the parameters.</p>
<p>It will validates the user credentials, and returns success response including a token if the authentication is correct or returns an error response if the authentication is failed.</p>
<pre><code>curl --location 'https://example.com/wp-json/auth/v1/token' \
--header 'Content-Type: application/json' \
--data-raw '{
    "username": "wordpress_username",
    "password": "wordpress_password"
}'
</code></pre>
<h4>Sample of success response</h4>
<pre><code>{
    "code": "simplejwt_auth_credential",
    "message": "Token created successfully",
    "data": {
        "status": 200,
        "id": "2",
        "email": "sayandey@outlook.com",
        "nicename": "sayan_dey",
        "display_name": "Sayan Dey",
        "token": "eyJ0eXAiOiJKV1QiLCJhbGciO........."
    }
}
</code></pre>
<h4>Sample of error response</h4>
<pre><code>{
    "code": "simplejwt_invalid_username",
    "message": "Error: The username admin_user is not registered on this site. If you are unsure of your username, try your email address instead.",
    "data": {
        "status": 403
    }
}
</code></pre>
<p>Once you get the token, you can store it somewhere in your application:</p>
<ul>
<li>using <strong>Cookie</strong> </li>
<li>or using <strong>localstorage</strong> </li>
<li>or using a wrapper like <a href="https://localforage.github.io/localForage/" rel="nofollow ugc">localForage</a> or <a href="https://pouchdb.com/" rel="nofollow ugc">PouchDB</a></li>
<li>or using local database like SQLite</li>
<li>or your choice based on app you develop</li>
</ul>
<p>Then you should pass this token as <em>Bearer Authentication</em> header to every API call.</p>
<pre><code>Authorization: Bearer your-generated-token
</code></pre>
<p>Here is an example to create WordPress post using JWT token authentication.</p>
<pre><code>curl --location 'https://example.com/wp-json/wp/v2/posts' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciO.........' \
--data '{
    "title": "Dummy post through API",
    "content": "Lorem Ipsum is simply dummy text of the printing and typesetting industry.",
    "status": "publish",
    "tags": [
        4,
        5,
        6
    ]
}'
</code></pre>
<p>Plugin’s middleware intercepts every request to the server, checking for the presence of the <strong>Authorization</strong> header. If the header is found, it attempts to decode the JWT token contained within.</p>
<p>Upon successful decoding, the middleware extracts the user information stored in the token and authenticates the user accordingly, ensuring that only authorized requests are processed.</p>
<h3>Validating Token</h3>
<p>This is a helper endpoint to validate a token. You only will need to make a <strong>POST</strong> request sending the Bearer Authorization header.</p>
<pre><code>curl --location --request POST 'https://example.com/wp-json/auth/v1/token/validate' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciO.........'
</code></pre>
<h4>Sample of success response</h4>
<pre><code>{
    "code": "simplejwt_valid_token",
    "message": "Token is valid",
    "data": {
        "status": 200
    }
}
</code></pre>
<h3>REST Errors</h3>
<p>If the token is invalid an error will be returned, here are some samples of errors.</p>
<h4>Invalid Username</h4>
<pre><code>{
    "code": "simplejwt_invalid_username",
    "message": "Error: The username admin is not registered on this site. If you are unsure of your username, try your email address instead.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Password</h4>
<pre><code>{
    "code": "simplejwt_incorrect_password",
    "message": "Error: The password you entered for the username tiyasha_das is incorrect. Lost your password?",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Signature</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Signature verification failed",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Syntax error, malformed JSON",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Expired Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Expired token",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>No Authorization</h4>
<pre><code>{
    "code": "simplejwt_no_auth_header",
    "message": "Authorization header not found",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Authorization</h4>
<pre><code>{
    "code": "simplejwt_bad_auth_header",
    "message": "Authorization header malformed",
    "data": {
        "status": 400
    }
}
</code></pre>
<h4>Wrong Algorithm Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Incorrect key for this algorithm",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Unsupported Algorithm</h4>
<pre><code>{
    "code": "simplejwt_unsupported_algorithm",
    "message": "Unsupported algorithm see https://tinyurl.com/uf4ns6fm",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Configuration</h4>
<pre><code>{
    "code": "simplejwt_bad_config",
    "message": "JWT is not configured properly, please contact the admin",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Encryption Key</h4>
<pre><code>{
    "code": "simplejwt_bad_encryption_key",
    "message": "Encryption key is not configured properly.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Encryption Key Length</h4>
<pre><code>{
    "code": "simplejwt_invalid_enckey_length",
    "message": "Encryption key must be exactly 32 characters long",
    "data": {
        "status": 400
    }
}
</code></pre>
<h3>Available Hooks</h3>
<p><strong>Simple JWT Auth</strong> is a developer-friendly plugin. It has various filter hooks available to override the default settings.</p>
<h4>simplejwt_cors_allow_headers</h4>
<p>The <code>simplejwt_cors_allow_headers</code> allows you to modify the available headers when the Cross-Origin Resource Sharing (CORS) support is enabled.</p>
<p>Default value:</p>
<pre><code>'Access-Control-Allow-Headers, Content-Type, Authorization'
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the allowed CORS headers.
 *
 * @param   string $headers The allowed headers.
 * @return  string The allowed headers.
 */
add_filter("simplejwt_cors_allow_headers", function ($headers) {
    // Modify the headers here.
    return $headers;
});
</code></pre>
<h4>simplejwt_auth_iss</h4>
<p>The <code>simplejwt_auth_iss</code> allows you to change the <a href="https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1" rel="nofollow ugc"><strong>iss</strong></a> value before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>get_bloginfo( 'url' );
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token issuer.
 *
 * @param   string $iss The token issuer.
 * @return  string The token issuer.
 */
add_filter("simplejwt_auth_iss", function ($iss) {
    // Modify the "iss" here.
    return $iss;
});
</code></pre>
<h4>simplejwt_not_before</h4>
<p>The <code>simplejwt_not_before</code> allows you to change the <a href="https://tools.ietf.org/html/rfc7519#section-4.1.5" rel="nofollow ugc"><strong>nbf</strong></a> value before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>time();
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token's nbf value.
 *
 * @param   int $not_before The default "nbf" value in timestamp.
 * @param   int $issued_at The "iat" value in timestamp.
 * @return  int The "nbf" value.
 */
add_filter(
    "simplejwt_not_before",
    function ($not_before, $issued_at) {
        // Modify the "not_before" here.
        return $not_before;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_auth_expire</h4>
<p>The <code>simplejwt_auth_expire</code> allows you to change the value <a href="https://tools.ietf.org/html/rfc7519#section-4.1.4" rel="nofollow ugc"><strong>exp</strong></a> before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>time() + ( DAY_IN_SECONDS * 7 )
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token's expire value.
 *
 * @param   int $expire The default "exp" value in timestamp.
 * @param   int $issued_at The "iat" value in timestamp.
 * @return  int The "nbf" value.
 */
add_filter(
    "simplejwt_auth_expire",
    function ($expire, $issued_at) {
        // Modify the "expire" here.
        return $expire;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_payload_before_sign</h4>
<p>The <code>simplejwt_payload_before_sign</code> allows you to modify all the payload data before being encoded and signed.</p>
<p>Default value:</p>
<pre><code>$payload = [
    "iss" => $this->simplejwt_get_iss(),
    "iat" => $issued_at,
    "nbf" => $not_before,
    "exp" => $expire,
    "data" => [
        "user" => [
            "id" => $user->data->ID,
        ],
    ],
];
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Modify the payload data before being encoded & signed.
 *
 * @param   array $payload The default payload
 * @param   WP_User $user The authenticated user.
 * @return  array The payloads data.
 */
add_filter(
    "simplejwt_payload_before_sign",
    function ($payload, $user) {
        // Modify the payload here.
        return $payload;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_token_before_dispatch</h4>
<p>The <code>simplejwt_token_before_dispatch</code> allows you to modify the token response before to dispatch it to the client.</p>
<p>Default value:</p>
<pre><code>$data = new WP_REST_Response(
    [
        "code" => "simplejwt_auth_credential",
        "message" => JWTNotice::get_notice("auth_credential"),
        "data" => [
            "status" => 200,
            "id" => $user->data->ID,
            "email" => $user->data->user_email,
            "nicename" => $user->data->user_nicename,
            "display_name" => $user->data->display_name,
            "token" => $token,
        ],
    ],
    200,
);
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Modify the JWT response before dispatch.
 *
 * @param   WP_REST_Response $data The token response data.
 * @param   WP_User $user The user object for whom the token is being generated.
 * @return  WP_REST_Response Modified token response data.
 */
add_filter(
    "simplejwt_token_before_dispatch",
    function ($data, $user) {
        // Modify the response data.
        if ($user instanceof WP_User) {
        }
        return $data;
    },
    10,
    2,
);
</code></pre>
<h3>Credits</h3>
<ul>
<li><a href="https://developer.wordpress.org/rest-api/" rel="nofollow ugc">WordPress REST API</a></li>
<li><a href="https://github.com/firebase/php-jwt" rel="nofollow ugc">php-jwt by Firebase</a></li>
</ul>


Simple JWT Auth

Extends the WP REST API using JSON Web Tokens for robust authentication, providing a secure and reliable way to access and manage WordPress data.

AH JWT Auth vs Simple JWT Auth