Sébastien Dumont

CoCart Headless

<p>This free add-on for <a href="https://cocartapi.com/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">CoCart</a> allows you to authenticate the Cart API via JSON Web Tokens as an authentication method.</p>
<p>JSON Web Tokens are an open standard <a href="https://datatracker.ietf.org/doc/html/rfc7519" rel="nofollow ugc">RFC 7519</a> for securely transmitting information between parties.</p>
<p><a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/concepts.md" rel="nofollow ugc">Read the core concept for more information</a> on what this plugin does and can do.</p>
<p>★★★★★</p>
<blockquote>
<p>An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time. <a href="https://wordpress.org/support/topic/excellent-plugin-8062/" rel="ugc">Harald Schneider</a></p>
</blockquote>
<h3>Key Features</h3>
<ul>
<li><strong>Standard JWT Authentication</strong>: Implements the industry-standard RFC 7519 for secure claims representation.</li>
<li><strong>Simple Endpoints</strong>: Offers clear endpoints for generating and validating tokens.</li>
<li><strong>Configurable Secret Key</strong>: Define your unique secret key via <code>wp-config.php</code> for secure token signing.</li>
<li><strong>Multiple signing algorithms</strong>: <code>HS256</code>, <code>HS384</code>, <code>HS512</code>, <code>RS256</code>, <code>RS384</code>, <code>RS512</code>, <code>ES256</code>, <code>ES384</code>, <code>ES512</code>, <code>PS256</code>, <code>PS384</code>, <code>PS512</code></li>
<li><strong>Rate Limiting</strong>: Controlled specifically for refreshing and validating tokens. Requires <a href="https://cocartapi.com/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart Plus</a></li>
<li><strong>Helpful Debugging</strong>: Detailed logs of authentication issues to help figure out exactly what happened and fix it faster.</li>
<li><strong>WP-CLI Commands</strong>: Useful <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/wp-cli.md" rel="nofollow ugc">commands to handle tokens</a> – whether you need to check, destroy or create new ones, or clean up old ones.</li>
<li><strong>Developer Hooks</strong>: Provides <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/filters.md" rel="nofollow ugc">filters</a> and <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/hooks.md" rel="nofollow ugc">hooks</a> for more configuration to your requirements.</li>
</ul>
<p>For support, please join the <a href="https://cocartapi.com/community/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">community on Discord</a>. For priority support, consider upgrading to <a href="https://cocartapi.com/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">CoCart Plus</a>.</p>
<h3>📄 Documentation</h3>
<p>See documentation on how to <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/guide.md" rel="nofollow ugc">get setup</a>, <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/filters.md" rel="nofollow ugc">filters</a> and <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/hooks.md" rel="nofollow ugc">hooks</a> with examples to help configure JWT Authentication to your needs.</p>
<p>Once ready to use, see the <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/quick-start.md" rel="nofollow ugc">quick start guide</a>. There is also an <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/advanced-configuration.md" rel="nofollow ugc">advanced configuration</a> for using RSA Keys.</p>
<p>★★★★★</p>
<blockquote>
<p>Amazing Plugin. I’m using it to create a react-native app with WooCommerce as back-end. This plugin is a life-saver! <a href="https://wordpress.org/support/topic/amazing-plugin-1562/" rel="ugc">Daniel Loureiro</a></p>
</blockquote>
<h4>👍 Add-ons to further enhance CoCart</h4>
<p>We also have other add-ons that extend CoCart to enhance your headless store development.</p>
<ul>
<li><strong><a href="https://wordpress.org/plugins/cocart-cors/" rel="ugc">CoCart – CORS</a></strong> enables support for CORS to allow CoCart to work across multiple domains.</li>
<li><strong><a href="https://wordpress.org/plugins/cocart-rate-limiting/" rel="ugc">CoCart – Rate Limiting</a></strong> enables the rate limiting feature.</li>
<li>and more add-ons in development.</li>
</ul>
<p>These add-ons of course come with support too.</p>
<p>For additional security, consider our <a href="https://apisecurity.pro/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">API Security</a> plugin that provides a firewall to block unknown outsiders, rate limit requests and protect data exposure – no configuration required.</p>
<h3>⌨️ Join our growing community</h3>
<p>A Discord community for developers, WordPress agencies and shop owners building the fastest and best headless WooCommerce stores with CoCart.</p>
<p><a href="https://cocartapi.com/community/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">Join our community</a></p>
<h3>🐞 Bug reports</h3>
<p>Bug reports for CoCart – JWT Authentication are welcomed in the <a href="https://github.com/cocart-headless/cocart-jwt-authentication" rel="nofollow ugc">CoCart – JWT Authentication repository on GitHub</a>. Please note that GitHub is not a support forum, and that issues that aren’t properly qualified as bugs will be closed.</p>
<h3>More information</h3>
<ul>
<li>The official <a href="https://cocartapi.com/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart API plugin</a> website.</li>
<li><a href="https://cocart.dev/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart for Developers</a>, an official hub for resources you need to be productive with CoCart and keep track of everything that is happening with the API.</li>
<li>The CoCart <a href="https://cocartapi.com/docs/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">Documentation</a></li>
<li><a href="http://eepurl.com/dKIYXE" rel="nofollow ugc">Subscribe to updates</a></li>
<li>Like, Follow and Star on <a href="https://www.facebook.com/cocartforwc/" rel="nofollow ugc">Facebook</a>, <a href="https://twitter.com/cocartapi" rel="nofollow ugc">Twitter</a>, <a href="https://www.instagram.com/cocartheadless/" rel="nofollow ugc">Instagram</a> and <a href="https://github.com/co-cart/co-cart" rel="nofollow ugc">GitHub</a></li>
</ul>
<h4>💯 Credits</h4>
<p>This plugin is developed and maintained by <a href="https://twitter.com/sebd86" rel="nofollow ugc">Sébastien Dumont</a>.<br />
Founder of <a href="https://twitter.com/cocartheadless" rel="nofollow ugc">CoCart Headless, LLC</a>.</p>


CoCart JWT Authentication

Sayan Dey

<p>Extends the WordPress REST API using JSON Web Tokens for robust authentication and authorization.</p>
<p>JSON Web Token (JWT) is an open standard (<a href="https://tools.ietf.org/html/rfc7519" rel="nofollow ugc">RFC 7519</a>) that defines a compact and self-contained way for securely transmitting information between two parties.</p>
<p>It provides a secure and reliable way to access and manage WordPress data from external applications, making it ideal for building headless CMS solutions.</p>
<ul>
<li>Support & question: <a href="https://wordpress.org/support/plugin/simple-jwt-auth/" rel="ugc">WordPress support forum</a></li>
<li>Reporting plugin’s bug: <a href="https://github.com/sayandey18/simple-jwt-auth/issues" rel="nofollow ugc">GitHub issues tracker</a></li>
</ul>
<p><strong>Plugins GitHub Repo</strong> https://github.com/sayandey18/simple-jwt-auth</p>
<h3>Enable PHP HTTP Authorization Header</h3>
<p>HTTP Authorization is a mechanism that allows clients to provide credentials to servers, thereby gaining access to protected resources. This is typically achieved by sending a special header, the Authorization header, in the HTTP request.</p>
<h4>Shared Hosts</h4>
<p>Most shared hosts have disabled the <strong>HTTP Authorization Header</strong> by default.</p>
<p>To enable this option you’ll need to edit your <strong>.htaccess</strong> file by adding the following:</p>
<pre><code>RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</code></pre>
<h4>WPEngine</h4>
<p>To enable this option you’ll need to edit your .htaccess file adding the follow:</p>
<pre><code>SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
</code></pre>
<h3>Configuration</h3>
<p>Simple JWT Auth plugin needs a <strong>Signing Key</strong> to encrypt and decrypt the <strong>secret key</strong>, <strong>private key</strong>, and <strong>public key</strong>. This signing key must be exact 32 charecter long and never be revealed.</p>
<p>To add the <strong>signing key</strong> edit your <code>wp-config.php</code> file and add a new constant called <strong>SIMPLE_JWT_AUTH_ENCRYPT_KEY</strong></p>
<pre><code>define( 'SIMPLE_JWT_AUTH_ENCRYPT_KEY', 'your-32-char-signing-key' );
</code></pre>
<p>Generate a 32 charecter key from here: <a href="https://string-gen.netlify.app" rel="nofollow ugc">https://string-gen.netlify.app</a></p>
<p>Here is the sample response if the encryption key is not configured in wp-config.php file.</p>
<pre><code>{
    "code": "simplejwt_bad_encryption_key",
    "message": "Encryption key is not configured properly.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h3>REST Endpoints</h3>
<p>When the plugin is activated, a new namespace is added.</p>
<pre><code>/auth/v1
</code></pre>
<p>Also, two new endpoints are added to this namespace.</p>
<pre><code>*/wp-json/auth/v1/token          | POST
*/wp-json/auth/v1/token/validate | POST
</code></pre>
<h3>Requesting/Generating Token</h3>
<p>To generate a new token, submit a POST request to this endpoint. With <code>username</code> and <code>password</code> as the parameters.</p>
<p>It will validates the user credentials, and returns success response including a token if the authentication is correct or returns an error response if the authentication is failed.</p>
<pre><code>curl --location 'https://example.com/wp-json/auth/v1/token' \
--header 'Content-Type: application/json' \
--data-raw '{
    "username": "wordpress_username",
    "password": "wordpress_password"
}'
</code></pre>
<h4>Sample of success response</h4>
<pre><code>{
    "code": "simplejwt_auth_credential",
    "message": "Token created successfully",
    "data": {
        "status": 200,
        "id": "2",
        "email": "sayandey@outlook.com",
        "nicename": "sayan_dey",
        "display_name": "Sayan Dey",
        "token": "eyJ0eXAiOiJKV1QiLCJhbGciO........."
    }
}
</code></pre>
<h4>Sample of error response</h4>
<pre><code>{
    "code": "simplejwt_invalid_username",
    "message": "Error: The username admin_user is not registered on this site. If you are unsure of your username, try your email address instead.",
    "data": {
        "status": 403
    }
}
</code></pre>
<p>Once you get the token, you can store it somewhere in your application:</p>
<ul>
<li>using <strong>Cookie</strong> </li>
<li>or using <strong>localstorage</strong> </li>
<li>or using a wrapper like <a href="https://localforage.github.io/localForage/" rel="nofollow ugc">localForage</a> or <a href="https://pouchdb.com/" rel="nofollow ugc">PouchDB</a></li>
<li>or using local database like SQLite</li>
<li>or your choice based on app you develop</li>
</ul>
<p>Then you should pass this token as <em>Bearer Authentication</em> header to every API call.</p>
<pre><code>Authorization: Bearer your-generated-token
</code></pre>
<p>Here is an example to create WordPress post using JWT token authentication.</p>
<pre><code>curl --location 'https://example.com/wp-json/wp/v2/posts' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciO.........' \
--data '{
    "title": "Dummy post through API",
    "content": "Lorem Ipsum is simply dummy text of the printing and typesetting industry.",
    "status": "publish",
    "tags": [
        4,
        5,
        6
    ]
}'
</code></pre>
<p>Plugin’s middleware intercepts every request to the server, checking for the presence of the <strong>Authorization</strong> header. If the header is found, it attempts to decode the JWT token contained within.</p>
<p>Upon successful decoding, the middleware extracts the user information stored in the token and authenticates the user accordingly, ensuring that only authorized requests are processed.</p>
<h3>Validating Token</h3>
<p>This is a helper endpoint to validate a token. You only will need to make a <strong>POST</strong> request sending the Bearer Authorization header.</p>
<pre><code>curl --location --request POST 'https://example.com/wp-json/auth/v1/token/validate' \
--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciO.........'
</code></pre>
<h4>Sample of success response</h4>
<pre><code>{
    "code": "simplejwt_valid_token",
    "message": "Token is valid",
    "data": {
        "status": 200
    }
}
</code></pre>
<h3>REST Errors</h3>
<p>If the token is invalid an error will be returned, here are some samples of errors.</p>
<h4>Invalid Username</h4>
<pre><code>{
    "code": "simplejwt_invalid_username",
    "message": "Error: The username admin is not registered on this site. If you are unsure of your username, try your email address instead.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Password</h4>
<pre><code>{
    "code": "simplejwt_incorrect_password",
    "message": "Error: The password you entered for the username tiyasha_das is incorrect. Lost your password?",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Signature</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Signature verification failed",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Syntax error, malformed JSON",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Expired Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Expired token",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>No Authorization</h4>
<pre><code>{
    "code": "simplejwt_no_auth_header",
    "message": "Authorization header not found",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Authorization</h4>
<pre><code>{
    "code": "simplejwt_bad_auth_header",
    "message": "Authorization header malformed",
    "data": {
        "status": 400
    }
}
</code></pre>
<h4>Wrong Algorithm Token</h4>
<pre><code>{
    "code": "simplejwt_invalid_token",
    "message": "Incorrect key for this algorithm",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Unsupported Algorithm</h4>
<pre><code>{
    "code": "simplejwt_unsupported_algorithm",
    "message": "Unsupported algorithm see https://tinyurl.com/uf4ns6fm",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Configuration</h4>
<pre><code>{
    "code": "simplejwt_bad_config",
    "message": "JWT is not configured properly, please contact the admin",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Bad Encryption Key</h4>
<pre><code>{
    "code": "simplejwt_bad_encryption_key",
    "message": "Encryption key is not configured properly.",
    "data": {
        "status": 403
    }
}
</code></pre>
<h4>Invalid Encryption Key Length</h4>
<pre><code>{
    "code": "simplejwt_invalid_enckey_length",
    "message": "Encryption key must be exactly 32 characters long",
    "data": {
        "status": 400
    }
}
</code></pre>
<h3>Available Hooks</h3>
<p><strong>Simple JWT Auth</strong> is a developer-friendly plugin. It has various filter hooks available to override the default settings.</p>
<h4>simplejwt_cors_allow_headers</h4>
<p>The <code>simplejwt_cors_allow_headers</code> allows you to modify the available headers when the Cross-Origin Resource Sharing (CORS) support is enabled.</p>
<p>Default value:</p>
<pre><code>'Access-Control-Allow-Headers, Content-Type, Authorization'
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the allowed CORS headers.
 *
 * @param   string $headers The allowed headers.
 * @return  string The allowed headers.
 */
add_filter("simplejwt_cors_allow_headers", function ($headers) {
    // Modify the headers here.
    return $headers;
});
</code></pre>
<h4>simplejwt_auth_iss</h4>
<p>The <code>simplejwt_auth_iss</code> allows you to change the <a href="https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1" rel="nofollow ugc"><strong>iss</strong></a> value before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>get_bloginfo( 'url' );
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token issuer.
 *
 * @param   string $iss The token issuer.
 * @return  string The token issuer.
 */
add_filter("simplejwt_auth_iss", function ($iss) {
    // Modify the "iss" here.
    return $iss;
});
</code></pre>
<h4>simplejwt_not_before</h4>
<p>The <code>simplejwt_not_before</code> allows you to change the <a href="https://tools.ietf.org/html/rfc7519#section-4.1.5" rel="nofollow ugc"><strong>nbf</strong></a> value before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>time();
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token's nbf value.
 *
 * @param   int $not_before The default "nbf" value in timestamp.
 * @param   int $issued_at The "iat" value in timestamp.
 * @return  int The "nbf" value.
 */
add_filter(
    "simplejwt_not_before",
    function ($not_before, $issued_at) {
        // Modify the "not_before" here.
        return $not_before;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_auth_expire</h4>
<p>The <code>simplejwt_auth_expire</code> allows you to change the value <a href="https://tools.ietf.org/html/rfc7519#section-4.1.4" rel="nofollow ugc"><strong>exp</strong></a> before the payload is encoded to be a token.</p>
<p>Default value:</p>
<pre><code>time() + ( DAY_IN_SECONDS * 7 )
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Change the token's expire value.
 *
 * @param   int $expire The default "exp" value in timestamp.
 * @param   int $issued_at The "iat" value in timestamp.
 * @return  int The "nbf" value.
 */
add_filter(
    "simplejwt_auth_expire",
    function ($expire, $issued_at) {
        // Modify the "expire" here.
        return $expire;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_payload_before_sign</h4>
<p>The <code>simplejwt_payload_before_sign</code> allows you to modify all the payload data before being encoded and signed.</p>
<p>Default value:</p>
<pre><code>$payload = [
    "iss" => $this->simplejwt_get_iss(),
    "iat" => $issued_at,
    "nbf" => $not_before,
    "exp" => $expire,
    "data" => [
        "user" => [
            "id" => $user->data->ID,
        ],
    ],
];
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Modify the payload data before being encoded & signed.
 *
 * @param   array $payload The default payload
 * @param   WP_User $user The authenticated user.
 * @return  array The payloads data.
 */
add_filter(
    "simplejwt_payload_before_sign",
    function ($payload, $user) {
        // Modify the payload here.
        return $payload;
    },
    10,
    2,
);
</code></pre>
<h4>simplejwt_token_before_dispatch</h4>
<p>The <code>simplejwt_token_before_dispatch</code> allows you to modify the token response before to dispatch it to the client.</p>
<p>Default value:</p>
<pre><code>$data = new WP_REST_Response(
    [
        "code" => "simplejwt_auth_credential",
        "message" => JWTNotice::get_notice("auth_credential"),
        "data" => [
            "status" => 200,
            "id" => $user->data->ID,
            "email" => $user->data->user_email,
            "nicename" => $user->data->user_nicename,
            "display_name" => $user->data->display_name,
            "token" => $token,
        ],
    ],
    200,
);
</code></pre>
<p>Usage example:</p>
<pre><code>/**
 * Modify the JWT response before dispatch.
 *
 * @param   WP_REST_Response $data The token response data.
 * @param   WP_User $user The user object for whom the token is being generated.
 * @return  WP_REST_Response Modified token response data.
 */
add_filter(
    "simplejwt_token_before_dispatch",
    function ($data, $user) {
        // Modify the response data.
        if ($user instanceof WP_User) {
        }
        return $data;
    },
    10,
    2,
);
</code></pre>
<h3>Credits</h3>
<ul>
<li><a href="https://developer.wordpress.org/rest-api/" rel="nofollow ugc">WordPress REST API</a></li>
<li><a href="https://github.com/firebase/php-jwt" rel="nofollow ugc">php-jwt by Firebase</a></li>
</ul>


Simple JWT Auth

Extends the WP REST API using JSON Web Tokens for robust authentication, providing a secure and reliable way to access and manage WordPress data.

CoCart JWT Authentication vs Simple JWT Auth