atmosphere_client_metadata

Filters the OAuth client metadata served at the REST endpoint.

Filters MUST return an array containing:

• client_id: non-empty string (advertised as the OAuth client identifier; should match Client::client_id()).
• redirect_uris: non-empty list of non-empty strings, where every entry is rooted at this site's admin over HTTPS (admin_url('', 'https') prefix). Off-site / empty / non-string / HTTP-scheme / nested-array entries cause the entire filter result to be rejected.

Anything else falls back to the unfiltered metadata. The metadata endpoint is public and the document advertises token_endpoint_auth_method: 'none' (public client), so an attacker-supplied redirect_uris entry would let them drive this site's client_id with their own redirect target. Gate entries individually, matching the validation the inbound atmosphere_oauth_redirect_uri filter.

Auto-generated Example

/**
 * Filters the OAuth client metadata served at the REST endpoint.
 * 
 * Filters MUST return an array containing:
 * 
 * - `client_id`: non-empty string (advertised as the OAuth client
 * identifier; should match `Client::client_id()`).
 * - `redirect_uris`: non-empty list of non-empty strings, where
 * every entry is rooted at this site's admin over HTTPS
 * (`admin_url('', 'https')` prefix). Off-site / empty /
 * non-string / HTTP-scheme / nested-array entries cause the
 * entire filter result to be rejected.
 * 
 * Anything else falls back to the unfiltered metadata. The
 * metadata endpoint is public and the document advertises
 * `token_endpoint_auth_method: 'none'` (public client), so an
 * attacker-supplied `redirect_uris` entry would let them drive
 * this site's `client_id` with their own redirect target. Gate
 * entries individually, matching the validation
 * the inbound `atmosphere_oauth_redirect_uri` filter.
 *
 * @param array $metadata 
 * @return array The filtered value.
 */
function my_atmosphere_client_metadata_callback( array $metadata ) {
    // Your code here.
    return $metadata;
}
add_filter( 'atmosphere_client_metadata', 'my_atmosphere_client_metadata_callback' );

Parameters

• array $metadata Client metadata.

Files

• includes/wp-admin/class-admin.php:926

\apply_filters( 'atmosphere_client_metadata', $metadata )

← All Hooks