WordPress 教程：自定義 WP REST API (WP API) 授權

/** 

 * Check the authentication headers if supplied 

 * 

 * @return WP_Error|null WP_Error indicates unsuccessful login, null indicates successful or no authentication provided 

 */ 

public function check_authentication() { 

    /** 

     * Pass an authentication error to the API 

     * 

     * This is used to pass a {@see WP_Error} from an authentication method 

     * back to the API. 

     * 

     * Authentication methods should check first if they're being used, as 

     * multiple authentication methods can be enabled on a site (cookies, 

     * HTTP basic auth, OAuth). If the authentication method hooked in is 

     * not actually being attempted, null should be returned to indicate 

     * another authentication method should check instead. Similarly, 

     * callbacks should ensure the value is `null` before checking for 

     * errors. 

     * 

     * A {@see WP_Error} instance can be returned if an error occurs, and 

     * this should match the format used by API methods internally (that is, 

     * the `status` data should be used). A callback can return `true` to 

     * indicate that the authentication method was used, and it succeeded. 

     * 

     * @param WP_Error|null|boolean WP_Error if authentication error, null if authentication method wasn't used, true if authentication succeeded 

     */ 

    return apply_filters( 'json_authentication_errors', null ); 

}

/** 

* WP JSON API 認證檢查 

* @param  null 

* @return boolean     是否認證成功 

* @author suifengtec  coolwp.com 

*/ 

function coolwp_rest_api_auth_check( $result ){ 

   if( 

        !isset($_GET['id']) 

       // ||!isset($_GET['app_key']) 

        ||!isset($_GET['app_token']) 

        ||empty($_GET['id']) 

       // ||empty($_GET['app_key']) 

        ||empty($_GET['app_token']) 

    ){ 

         return false; 

    } 

    //獲取從應用 GET 過來的用户 id 、 app_key 和 app_token, 當然了，你也可以只用一個去 app_key 和 app_token 中的任何一個去檢查 

    $user_id =  (int)$_GET['id']; 

   // $app_key = sanitize_text_field($_GET['app_key']); 

    $app_token = sanitize_text_field($_GET['app_token']); 

    //查詢 app_key 和 app_token, 當然了, 你也可以自定義一種算法, 

    //$wp_key = get_user_meta( $user_id, 'app_key', true); 

    $wp_token = get_user_meta( $user_id, 'app_token', true); 

    //將從應用客户端獲取到的值與數據庫存儲的值進行對比 

    if( 

        ( $wp_token == $app_token ) 

       // &&( $wp_key == $app_key ) 

    ){ 

       return true; 

    } 

    return false; 

} 

add_filter('json_authentication_errors', 'coolwp_rest_api_auth_check');