Secure all rest api endpoints

[shotor]

Is there a way to secure all public rest api endpoints?

I'd like to secure the pages endpoint (and any other page) so it's only accessible with an api key. But if I make a request without JWT it just goes through.

I couldn't find a way to change this in the settings

[melomontoya]

Or is there a way to validate the token tru PHP? I would like to validate the token on some endpoints.

[nicumicle]

Have you tried the "Force login" (https://wordpress.org/plugins/wp-force-login/) plugin?

[melomontoya]

Hi, "Force login" plugin doesn't fit 'cause it checks for "if( ! is_user_logged_in())" which doesn't work with JWT or nothing compatible with our APP. Is there a proper/safe way to make the "whitelist" work. We have tried the "1 file plugin" and "function.php" but it doesn't work.
Thanks

[melomontoya]

Ok, after some digging we figured it out. Seems like the problem was the "array_merge" between both arrays. We changed it fot a foreach loop that "pushes" each endpoint and now it works. Oh, btw, it is also a one file plugin 'cause it wouldn't work on the functions.php

This is the final code

`/////////////////////////////////////////
//////// JWT WHITELIST para endpoints sin verificacion
/////////////////////////////////////////

if ( ! defined( 'ABSPATH' ) ) {
exit; // Exit if accessed directly.
}

/----------------------------------------------------------------------------/
/**

• JWT whitelist
  */

add_filter(
'jwt_auth_whitelist',
function ( $endpoints ) {
$whitelists = array(
'/wp-json/MYENDPOINT/v1/home',
'/wp-json/MYENDPOINT/v1/stripewebhook'
);

	foreach ( $whitelists as $whitelist ) {
		if ( ! in_array( $whitelist, $endpoints, true ) ) {
			array_push( $endpoints, $whitelist );
		}
	}

	return $endpoints;
}

);

?>
`

[kristjanmar]

I'm interested in this as well. What did you do to restrict the endpoints before adding the whitelist code?

[nicumicle]

Hello @shotor @melomontoya @kristjanmar,

The tag 3.4.0 has this functionality. You can not secure all rest endpoints or only specific endpoints with a JWT.
Also, when you secure all endpoints, you can set a specific list that can be whitelisted.

Please let me know what do you think.

Best regards,
Nicu.