Skip to content

Hatch v0.1.3 — REST-lock no longer 404s the headless frontend

Choose a tag to compare

View all tags
@adityaarsharma adityaarsharma released this 20 May 12:40
v0.1.3
18a8230

Fixed: enabling "Lock the REST API" 404'd every page on the headless frontend.

The Astro starter fetches every render via /hatch/v1/content?slug=… (the universal post / page / CPT resolver). That route was missing from the REST-lock public allowlist, so anonymous requests from the Astro frontend got 401 → Astro had no content → returned 404 to the visitor.

Added two routes to the public allowlist in Hatch_Security::block_rest_unauthenticated_dispatch:

  • /hatch/v1/content — universal content resolver. Already enforces post_status: publish internally, so making it public exposes nothing that wasn't already public.
  • /hatch/v1/post/{id}/blocks — block tree endpoint. Handler enforces context=edit auth internally; context=view (the public default) is safe.

REST API stays locked for /wp/v2/* — the Astro frontend authenticates those with its Application Password. Only the Hatch namespace's intentionally-public reads are now reachable anonymously.

Assets 3
Loading