WordPress 教程：自定义 WP REST API (WP API) 授权

/** 

 * Check the authentication headers if supplied 

 * 

 * @return WP_Error|null WP_Error indicates unsuccessful login, null indicates successful or no authentication provided 

 */ 

public function check_authentication() { 

    /** 

     * Pass an authentication error to the API 

     * 

     * This is used to pass a {@see WP_Error} from an authentication method 

     * back to the API. 

     * 

     * Authentication methods should check first if they're being used, as 

     * multiple authentication methods can be enabled on a site (cookies, 

     * HTTP basic auth, OAuth). If the authentication method hooked in is 

     * not actually being attempted, null should be returned to indicate 

     * another authentication method should check instead. Similarly, 

     * callbacks should ensure the value is `null` before checking for 

     * errors. 

     * 

     * A {@see WP_Error} instance can be returned if an error occurs, and 

     * this should match the format used by API methods internally (that is, 

     * the `status` data should be used). A callback can return `true` to 

     * indicate that the authentication method was used, and it succeeded. 

     * 

     * @param WP_Error|null|boolean WP_Error if authentication error, null if authentication method wasn't used, true if authentication succeeded 

     */ 

    return apply_filters( 'json_authentication_errors', null ); 

}

/** 

* WP JSON API 认证检查 

* @param  null 

* @return boolean     是否认证成功 

* @author suifengtec  coolwp.com 

*/ 

function coolwp_rest_api_auth_check( $result ){ 

   if( 

        !isset($_GET['id']) 

       // ||!isset($_GET['app_key']) 

        ||!isset($_GET['app_token']) 

        ||empty($_GET['id']) 

       // ||empty($_GET['app_key']) 

        ||empty($_GET['app_token']) 

    ){ 

         return false; 

    } 

    //获取从应用 GET 过来的用户 id 、 app_key 和 app_token, 当然了，你也可以只用一个去 app_key 和 app_token 中的任何一个去检查 

    $user_id =  (int)$_GET['id']; 

   // $app_key = sanitize_text_field($_GET['app_key']); 

    $app_token = sanitize_text_field($_GET['app_token']); 

    //查询 app_key 和 app_token, 当然了, 你也可以自定义一种算法, 

    //$wp_key = get_user_meta( $user_id, 'app_key', true); 

    $wp_token = get_user_meta( $user_id, 'app_token', true); 

    //将从应用客户端获取到的值与数据库存储的值进行对比 

    if( 

        ( $wp_token == $app_token ) 

       // &&( $wp_key == $app_key ) 

    ){ 

       return true; 

    } 

    return false; 

} 

add_filter('json_authentication_errors', 'coolwp_rest_api_auth_check');