http_authorizaion header #1

itibook · 2015-08-31T20:28:14Z

Hi there,

playing around with your plugin... looks really well done. I had some issues with the Authorization header not showing up. I googled around and found this. I used it instead of your htaccess code and it did the trick for me... hope it helps others

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

Tmeister · 2015-08-31T22:23:09Z

Hey Thanks,

Can you please tell me your server setup, is a local install or a live server to include the info in the readme file.

itibook · 2015-09-01T07:13:35Z

Live server on WPEngine...

your plugin works like a charm! Where can I pay you a beer? :-)

simonh1000 · 2017-04-14T04:51:52Z

I needed this line too with a simple apache setup on my dev machine. As I did not know what WPEngine is I ignored this first time around and lost some time with rest_forbidden errors as a result. I'm not sure what would be an accurate change, but I do suggest updating the README a little

gravyplaya · 2017-04-19T23:25:13Z

I added the lines to my htaccess. I an getting the following error.
{"code":"jwt_auth_bad_auth_header","message":"Authorization header malformed.","data":{"status":403}}
I am on wpengine and php7.

---- htaccess begin ------

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

-----htaccess end-----

tiomno · 2017-12-03T07:52:52Z

For users of AWS Lightsail with a bitnami/WordPress instance:

To make this work go and edit /home/bitnami/apps/wordpress/conf/htaccess.conf and set the SetEnvIf statement there:

RewriteEngine On
RewriteRule /<none> / [L,R]

#Right here worked for me!!!
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

<IfDefine USE_PHP_FPM>
    <Proxy "unix:/opt/bitnami/php/var/run/wordpress.sock|fcgi://wordpress-fpm" timeout=300>
    </Proxy>
</IfDefine>
...

Don't forget to restart Apache!

It didn't work for me in the .htaccess. :(

riteshtailor2002 · 2018-01-30T15:58:32Z

Getting error after configuring this plugin as per the steps mentioned over here : https://wordpress.org/plugins/jwt-authentication-for-wp-rest-api/

Error :
{
"code": "jwt_auth_bad_auth_header",
"message": "Authorization header malformed.",
"data": {
"status": 403
}
}

Any suggestion ?

tiomno · 2018-01-30T23:01:19Z

@riteshtailor2002 what is your server setup? If Apache + PHP do you access to httpd.conf?

Mulli · 2018-02-06T16:05:30Z

Have the same(?) problem:
{"code":"jwt_auth_bad_auth_header","message":"Authorization header malformed.","data":{"status":403}}
WP 4.9.3, JWT 1.2.4, PHP 7+
Hosting: shared on SiteGround with Apache.
No special tweaks.

My .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
</IfModule>
# END HTTPS
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

#SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

</IfModule>

# END WordPress

``

tiomno · 2018-02-06T22:22:44Z

@Mulli, this is me just guessing; I have no idea how the mode_rewrite of Apache works or environment variables manipulation for that matter.

Have you tried to move the line SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 to the very beginning of the .htaccess file? Out of any block?

nabilzidane · 2018-02-24T14:37:48Z

Hi guys.
This is the right way to add your code in the htaccess file and it's work fine for me.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
</IfModule>
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
# END WordPress

This line SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 must be outside of IFMODULE

nabilzidane · 2018-02-24T14:42:52Z

I have only one problem,
If I add a new plugin, or change my theme. I loose my JWT config on the htaccess.
Do I have to edit it every time?

nabilzidane · 2018-02-24T14:45:26Z

Hi @Mulli
You have to remove the # before SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

tiomno · 2018-02-25T01:31:18Z

@nabilzidane what about moving the line SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 out of the block # BEGIN WordPress <-> # END WordPress.
Put that line after # END WordPress and try again. Hope that fixes the problem. :)

alexbjorlig · 2018-11-14T13:45:50Z

@itibook can you share your .htaccess setup?

I am running wordpress on wp-engine, and using the code suggested by @nabilzidane does not work. The error I get is { "code": "rest_cannot_access", "message": "Only authenticated users can access the REST API.", "data": { "status": 401 } }, not sure if it's related?

itibook · 2018-11-14T15:00:33Z

@dauledk I haven't tried it out in a long time, but this is what I had at the time... wouldn't be surprised if it doesn't work anymore

###################################################
# Used for the the JWT Plugin
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

alexbjorlig · 2018-11-14T15:01:47Z

@itibook ok, I gave up and is now successfully using the https://wordpress.org/plugins/application-passwords/ plugin instead and it works. But thanks

N-Molham · 2019-02-24T17:20:39Z

@Tmeister what is the solution for other special hosting env like FlyWheel or pantheon ?

mikedoubintchik · 2019-07-10T20:04:25Z

I added the lines to my htaccess. I an getting the following error.
{"code":"jwt_auth_bad_auth_header","message":"Authorization header malformed.","data":{"status":403}}
I am on wpengine and php7.

---- htaccess begin ------
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
-----htaccess end-----

I got it working. The important part is the authorization header. It must be Authorization: 'Bearer ' (Bearer with a capital B)

axios.post(`${env.backendURL}/wp-json/jwt-auth/v1/token/validate`, {}, {headers: {Authorization: 'Bearer ' + localStorage.token}})
            .then(response => console.log(response))
            .catch(error => console.log(error.response));

eicksl · 2019-08-22T05:27:49Z

In my case it wasn't working because I was using SiteGround's staging environment. Works fine in production.

yagnikv · 2019-10-03T08:00:40Z

what is url for user logout api, means how to revoke user token

carlosen14 · 2019-10-17T18:52:10Z

@yagnikv remove the token from client. token on WP is not saved on DB, it just validates if it is still valid.

fabdelgado · 2020-04-16T01:05:30Z

How to configure this for nginx? I try with

global fastcgi config

fastcgi_pass_header Authorization;

server {
listen 80;
...}

but this not work. Any help?

dhsathiya · 2020-05-14T21:54:20Z

@fabdelgado and all the future Nginx-ers

These are the Nginx location blocks

location /app/login/ {
        try_files $uri $uri/ /index.php?$args;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param HTTP:Authorization $http_authorization;
        more_set_headers 'Authorization: $http_authorization';
        include fastcgi_params;
}
location ~ \.php$ {
        try_files $uri =404;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param HTTP:Authorization $http_authorization;
        more_set_headers 'Authorization: $http_authorization';
        include fastcgi_params;
        fastcgi_pass php;
}

Main part

        fastcgi_param HTTP:Authorization $http_authorization;
        more_set_headers 'Authorization: $http_authorization';

When you do curl request with

https://example.com/app/login -H 'Authorization: 1234123412341234'

The response will have

authorization: 1234123412341234

ahmedelatab · 2020-08-19T14:00:35Z

@tiomno

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 works with me, and can be placed outside the portions that might be rewritten in the .htaccess file.

And it is more suitable than placing the following lines after the RewriteBase / that is enclosed in the environment of WordPress since it will be rewritten frequently!

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

itibook · 2020-12-07T20:58:15Z

@alexbjorlig did you managed to get Application Passwords to work without any issues?

I can get it to work locally and works just fine when testing, but on WPEngine I am getting 403 from Nginx... no idea what else I could do

itibook · 2020-12-07T21:34:10Z

@alexbjorlig figured out the issue... not sure why, but WPEngine requires a User-Agent header when doing a call via the Python requests library, as silly as that.

jacobraccuia · 2020-12-08T22:31:23Z

I'm using WPEngine found this issue after intense debugging.... The app was logging into the wrong user account (the previously logged in user, i believe) when the User-Agent had the word google or facebook in it. I'm not sure if this is a WP API bug or a JWT bug or what. Currently passing a custom user agent to avoid this issue.

madhanshan0401 · 2021-06-25T16:01:59Z

I am trying JWT Authentication for WP-API for building an Flutter App for Wordpress . I am facing issue with login , Its working good for Administrator account but it not allows the user account to login . But for my case i need my users to login to view the content . Please help me
I tried to give permission through .htaccess file .
#SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
but no help .....

melomontoya · 2021-08-25T19:43:10Z

This might help if any of you guys are on AWS Lightsail Wordpress
https://www.youtube.com/watch?v=pmfVL3yeq84

ahinkle · 2022-08-03T14:08:10Z

(for anyone using WpEngine)

WpEngine has deprecated .htaccess in favor of their control panel. This is recommended by WpEngine support - I confirmed with them that this method is safe as to reach the jwt_auth_bad_auth_header header you must be authenticated.

Note: takes ~15-20 minutes to activate and work on their side.

Navigate to Web Rules -> Header Rules
Action: Set
Name: jwt_auth_bad_auth_header
Value: jwt_auth_bad_auth_header
When: 2xx Status Codes
Add Condition
Type: Header
Name: jwt_auth_bad_auth_header
Operator: Equal to (=)
Value: 1

davidglines · 2022-10-21T01:01:14Z

(for anyone using WpEngine)

WpEngine has deprecated .htaccess in favor of their control panel. This is recommended by WpEngine support - I confirmed with them that this method is safe as to reach the jwt_auth_bad_auth_header header you must be authenticated.

Note: takes ~15-20 minutes to activate and work on their side.

Navigate to Web Rules -> Header Rules

Action: Set

Name: jwt_auth_bad_auth_header

Value: jwt_auth_bad_auth_header

When: 2xx Status Codes

Add Condition

Type: Header

Name: jwt_auth_bad_auth_header

Operator: Equal to (=)

Value: 1

This did not work for us. We are still seeing the "authorization header not found" error.

Any other ideas?

jacobraccuia · 2022-10-21T01:53:49Z

Hi @davidglines,

I was not able to figure out what causes this issue for me. My production environment is currently working and authenticating as expected, but my staging env. wasn't. I spent hours with wpengine and we tried different things, including trying to recreate HTTP Authorization in nginx and what not, but we never figured it out.

I ended up destroying the staging envs and starting them over with fresh copies, and fortunately that is enough for me.

I never received the authorization header not found error, though. My issue was that users weren't being logged in via jwt - instead they were just getting access. So calls to woocommerce and to get their user profile didn't authenticate.

davidglines · 2022-10-21T03:37:42Z

Jacob, thanks for the information. We are still stuck and have tried 3-4 different nginx rules as well as Web rules at WPengine. No luck. We have escalated to senior techs and hoping it will get resolved very soon. Our users cannot log in to our React app. DG Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: jacobraccuia ***@***.***> Sent: Thursday, October 20, 2022 8:54:01 PM To: Tmeister/wp-api-jwt-auth ***@***.***> Cc: David Glines ***@***.***>; Mention ***@***.***> Subject: Re: [Tmeister/wp-api-jwt-auth] http_authorizaion header (#1) CAUTION: External Sender Hi @davidglines<https://github.com/davidglines>, I was not able to figure out what causes this issue for me. My production environment is currently working and authenticating as expected, but my staging env. wasn't. I spent hours with wpengine and we tried different things, including trying to recreate HTTP Authorization in nginx and what not, but we never figured it out. I ended up destroying the staging envs and starting them over with fresh copies, and fortunately that is enough for me. I never received the authorization header not found error, though. My issue was that users weren't being logged in via jwt - instead they were just getting access. So calls to woocommerce and to get their user profile didn't authenticate. — Reply to this email directly, view it on GitHub<#1 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AVOGGY4IWSUL2TUJEBV7DSTWEHZTTANCNFSM4BOVG25A>. You are receiving this because you were mentioned.Message ID: ***@***.***>

jacobraccuia · 2022-11-04T17:24:20Z

hey @davidglines, have you had any luck?

i'm not sure if my current issue is related, but a POST API call works perfectly in staging and in production it treats it like a GET call and returns the GET response..

davidglines · 2022-11-04T18:04:07Z

Hi, Jacob. We ended up going the WP login route as our clients needed to get into our app. If needed, we will give your plug-in a try again in the future. Thanks for checking in. DG Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: jacobraccuia ***@***.***> Sent: Friday, November 4, 2022 12:24:33 PM To: Tmeister/wp-api-jwt-auth ***@***.***> Cc: David Glines ***@***.***>; Mention ***@***.***> Subject: Re: [Tmeister/wp-api-jwt-auth] http_authorizaion header (#1) CAUTION: External Sender hey @davidglines<https://github.com/davidglines>, have you had any luck? i'm not sure if my current issue is related, but a POST API call works perfectly in staging and in production it treats it like a GET call and returns the GET response.. — Reply to this email directly, view it on GitHub<#1 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AVOGGY7QZBT5TSQMIVWOLBLWGVBFDANCNFSM4BOVG25A>. You are receiving this because you were mentioned.Message ID: ***@***.***>

gbg-webops · 2023-03-21T08:16:49Z

Did anyone ever find a solution to this? I've been looking for months and keep coming back to this issue thread hoping to find something. Seems pretty crazy that WP Engine would just drop support for .htaccess and then not have a reasonable alternative. If anyone know of a way to get around this or use a different solution all together, I'd love to hear about it.

Thanks!

gbg-webops · 2023-03-22T16:46:54Z

I was finally able to resolve this. I'll outline my fix below to hopefully help the next person if they are also running into this (although my gut tells me this is fairly unique to us)

Before I had a call to "/wp-json/wp/v2/users/me" as such in a js file:
return fetch.get('/wp-json/wp/v2/users/me)

I updated this to be:
return fetch.get('/wp-json/wp/v2/users/me?_wpnonce=' + wpr_object.rest_nonce)

Then I updated the script enqueue function in my php file to this:

public function enqueue_public_scripts() {
     if ($this->get_current_template() === 'page-virtual-instrument.php') {
         wp_enqueue_script($this->plugin_slug . '-public-script', plugins_url('assets/js/frontend.js', dirname(__FILE__)), array('jquery', 'wp-api-fetch'), $this->version);

		wp_localize_script( $this->plugin_slug . '-public-script', 'wpr_object', array(
			'rest_nonce'  	=> wp_create_nonce( 'wp_rest' ),
		)
		);
	}
}

Note the "wp_localize_script" that creates the "rest_nonce" variable referenced in the js file

Did anyone ever find a solution to this? I've been looking for months and keep coming back to this issue thread hoping to find something. Seems pretty crazy that WP Engine would just drop support for .htaccess and then not have a reasonable alternative. If anyone know of a way to get around this or use a different solution all together, I'd love to hear about it.

Thanks!

nicoandrade · 2023-06-16T14:32:32Z

I will leave this here, maybe it will help someone like me.

I was getting this error:

PHP Warning:  Undefined array key "HTTP_AUTHORIZATION" in .../wp-content/plugins/jwt-authentication-for-wp-rest-api/public/class-jwt-auth-public.php on line 222

This happened when using Insomnia (software like Postman) and making a GET request without any kind of Authorization.

There is a fix to be made in the code on that line
Replace this:

$auth_header = $_SERVER['HTTP_AUTHORIZATION'] ? sanitize_text_field( $_SERVER['HTTP_AUTHORIZATION'] ) : false;

With this:

$auth_header = array_key_exists( 'HTTP_AUTHORIZATION', $_SERVER ) && $_SERVER['HTTP_AUTHORIZATION'] ? sanitize_text_field( $_SERVER['HTTP_AUTHORIZATION'] ) : false;

I will suggest a PR with this fix.

Update:
There is already a PR created with something like this.

Tmeister closed this as completed in 0d91bb1 Sep 1, 2015

polushinmk mentioned this issue Nov 13, 2017

IsValidJWToken is false wp-net/WordPressPCL#81

Closed

dukaan mentioned this issue Oct 18, 2018

Only the full access role can use WP-REST API calls with authentication properly GM-Alex/user-access-manager#258

Open

chsalamin mentioned this issue Jan 7, 2021

JWT Malformed #212

Open

OEvans117 mentioned this issue Mar 10, 2022

How do I reuse the existing session/authentication from a logged in WP user? #234

Closed

AdilSoomro mentioned this issue Dec 10, 2022

Houzi App issue booleanbites/houzi-support#14

Closed

UUSR mentioned this issue May 13, 2023

When switching to RS256 nothing works. #278

Closed

nicoandrade mentioned this issue Jun 16, 2023

Added Extra Checks to Fix Error #270

Closed

http_authorizaion header #1

http_authorizaion header #1

Comments

itibook commented Aug 31, 2015

Tmeister commented Aug 31, 2015

itibook commented Sep 1, 2015

simonh1000 commented Apr 14, 2017

gravyplaya commented Apr 19, 2017 • edited Loading

tiomno commented Dec 3, 2017 • edited Loading

riteshtailor2002 commented Jan 30, 2018

tiomno commented Jan 30, 2018

Mulli commented Feb 6, 2018 • edited Loading

tiomno commented Feb 6, 2018

nabilzidane commented Feb 24, 2018 • edited Loading

nabilzidane commented Feb 24, 2018

nabilzidane commented Feb 24, 2018

tiomno commented Feb 25, 2018

alexbjorlig commented Nov 14, 2018 • edited Loading

itibook commented Nov 14, 2018 • edited Loading

alexbjorlig commented Nov 14, 2018

N-Molham commented Feb 24, 2019

mikedoubintchik commented Jul 10, 2019 • edited Loading

eicksl commented Aug 22, 2019

yagnikv commented Oct 3, 2019

carlosen14 commented Oct 17, 2019

fabdelgado commented Apr 16, 2020

global fastcgi config

dhsathiya commented May 14, 2020 • edited Loading

ahmedelatab commented Aug 19, 2020 • edited Loading

itibook commented Dec 7, 2020

itibook commented Dec 7, 2020 • edited Loading

jacobraccuia commented Dec 8, 2020

madhanshan0401 commented Jun 25, 2021

melomontoya commented Aug 25, 2021

ahinkle commented Aug 3, 2022 • edited Loading

davidglines commented Oct 21, 2022

jacobraccuia commented Oct 21, 2022

davidglines commented Oct 21, 2022 via email

jacobraccuia commented Nov 4, 2022

davidglines commented Nov 4, 2022 via email

gbg-webops commented Mar 21, 2023

gbg-webops commented Mar 22, 2023 • edited Loading

nicoandrade commented Jun 16, 2023 • edited Loading

gravyplaya commented Apr 19, 2017 •

edited

Loading

tiomno commented Dec 3, 2017 •

edited

Loading

Mulli commented Feb 6, 2018 •

edited

Loading

nabilzidane commented Feb 24, 2018 •

edited

Loading

alexbjorlig commented Nov 14, 2018 •

edited

Loading

itibook commented Nov 14, 2018 •

edited

Loading

mikedoubintchik commented Jul 10, 2019 •

edited

Loading

dhsathiya commented May 14, 2020 •

edited

Loading

ahmedelatab commented Aug 19, 2020 •

edited

Loading

itibook commented Dec 7, 2020 •

edited

Loading

ahinkle commented Aug 3, 2022 •

edited

Loading

gbg-webops commented Mar 22, 2023 •

edited

Loading

nicoandrade commented Jun 16, 2023 •

edited

Loading