authentication

[mohadesh]

hi
Which method is best for authenticate, especially in react native applications?
Cookie Authentication
Basic-Auth
OAuth
JWT

[samdoj]

I've been trying to use Basic-Auth. I always get an invalid user no matter what credentials I use, including the credentials I use to successfully login to my site for which I am an administrator! Something is very broken with the auth here at least when making a media request. I even tried setting auth: true and I still got an error that said I couldn't create a new post.

[breadadams]

Not sure if it's relevant to your issue but I just found out why JWT wasn't working for my app sometimes.

If I've got an open session in the WordPress admin, cookies are sent with the WpApi auth request for the user in that session, and that conflicts with the Autorization header for whichever user is being authorized through JWT.

[el-lsan]

@mohadesh @samdoj
Any solution ?

This is what i'm facing #388

[cawa-93]

@samdoj, @breadadams +1. I create Issue #400

[kadamwhite]

There's a couple different issues here, it seems. #400 should relate to situations where you are authenticating against the REST API from a browser session with an active login cookie; this is something we should probably patch upstream in WordPress.

If you're trying to use JWT or Basic Auth from a native application (not a webapp running in the browser), then that may represent a bug in this library rather than a limitation of WP itself. If you can share more information about how you're trying to authenticate from your native app, I may be able to help more.

To answer the question as posed:

• Cookie Authentication: for use in applications running in the browser in a WordPress plugin or theme
• JWT, OAuth, Basic Auth: for use authenticating from native applications, Node environments, or a webapp communicating with a site where you are not logged in and don't have an active WordPress cookie

[kadamwhite]

The issues described in comments around authentication problems are now tracked in separate tickets; thank you all for opening those. The comment above answers the issue as described, so I'm going to close out this ticket.