Add REST API key for security

[discobot]

As it is, the existing REST API does not secure itself with a key to prevent unauthorized access, much like how it happened back in WP version 4.7.1.

We need to increase the security around it as a whole.

---

Read-only archive: GitHub · Where software is built

Author: stefanos82

Vote count: 29

Status: open

Tags:

• request-add-feature

---

Comments

Well, seems like it’s happening WordPress 5.6 to Introduce Application Passwords for REST API Authentication – WP Tavern

~ posted by stefanos82

[viktor]

To try to keep up with WP security improvements, is this something we should consider backporting?

A related, but different discussion:

REST-API authentication option

Add option to expose REST-API only to authenticated users, maybe limited to a certain capability. Read-only archive: https://petitions.classicpress.net/posts/15/rest-api-authentication-option Author: Dora D. Vote count: 61 Status: open Tags: request-modify-feature difficulty-easy Comments

[viktor]

With v2 re-fork, we will keep WP’s application passwords. This petition will be closed, but if application passwords are not enough please open an issue on GitHub.