Protect Endpoints bug with Whitelisted and Protected endpoints

[psusu]

Bug Description

Hello!
Trying the new feature Protect Endpoints in the 3.4.0 version I've found a bug with whitelisted or protected endpoints.

I'm working in a subfolder WP install like www.mysite/subfolder
I'm looking in function isEndpointProtected($endpoint) in file ProtectEndpointService.php

The removeWpJsonFromEndpoint function called in lines 82 and 102 strips /wp-json from the strings:
if my string is www.mysite/**subfolder**/wp-json/endpoint the comparison is always wrong

The function removeWpJsonFromEndpoint changes the string in: www.mysite/subfolder/endpoint and on line 91 or 106 this string is compared with strpos() to www.mysite/subfolder/wp-json/endpoint and retrieves a wrong result

Environment

Question	Answer
PHP version	PHP 7.3
WordPress version	5.8.1
Simple-JWT-Login plugin version	3.4.0

[canonex]

I confirm.

I use apache userdir and my address is:
https://mydomain.net/~me/mywordpress

So, a possible route is
https://mydomain.net/~me/mywordpress/wp-json/xx/v1/endpoint

At this time only the domain is considered and not the siteurl or home as written in the db options.

The comparison fails, as stripping out the wp-json is equal comparing:
~me/mywordpress/wp-json/xx/v1/endpoint
and
~me/mywordpress/xx/v1/endpoint
which is therefore always false.

So I commented out the line:
//$protectedEndpoint = $this->removeWpJsonFromEndpoint($protectedEndpoint);
and inserted in the ui in "Protected endpoints" the complete path
/~me/mywordpress/wp-json/xx/v1/endpoint
and it works correctly.

It would be useful to have the full flow by removing not only the domain but the whole siteurl.
In this way you could simply insert
/wp-json/xx/v1/endpoint

Thank you,
Rickyx

ps. how to retrieve the user id from the authorized endpoint?

[nicumicle]

Hello @canonex @psusu

I did some fixes for this.

Can you please check on your side and let me know if it is working ok for you?

[canonex]

I'm sorry, I tried several options but I can't figure out what should I write in the Protected endpoints (using Apply only on Specific REST endpoints option) if I want to protect this endpoint:
https://mydomain.net/~me/mywordpress/wp-json/xx/v1/endpoint

Thank you,
Riccardo

[nicumicle]

Hello @canonex,

In the protect endpoints, you neet to add

• /wp-json/xx/v1/endpoint