Installed the WP API plugin and then the OAuth1 as well, but every time I go my dedicated server and try to run this

$ wp oauth1 add

It gives an error and nothing is returned. 

root@server1 [/home/site/www]# wp
-bash: wp: command not found

Any idea what I'm doing wrong? I can't figure it out.

Thank you

Ive been trying to get this to work with WP-API on my Wordpress install, using the chome extension postman to test the oauth api. For some reason, the signatures do not match. I have used the appropriate consumer key / secret and generated the signature just fine on the postman client, but when i test that against the oauth response, they never match up. in the file "class-wp-json-authentication-oauth1.php" on line 560 :

$signature = base64_encode( hash_hmac( $hash_algorithm, $string_to_sign, $key, true ) );

    if ( $signature !== $consumer_signature ) {
        return new WP_Error( 'json_oauth1_signature_mismatch', __( 'OAuth signature does not match'), array( 'status' => 401 ) );
    }

I have echoed the $signature along with the error message, and then tested that signature using postman, and indeed it worked. So, can someone explain to me how we can get this to function correctly ? (postman is just my intermediary step -- Im actually indending to use guzzle + subscribe)

Would be great if you can shine some more light in the docs on the actual authentication. I can see the authentication endpoint in the WP-API now but what are the next steps? How do I for example add consumer_keys?

When checking the OAuth signature, the comparison would fail if the WP blog was in a folder under the host. This code fixes the issue. It could probably be condensed but it gets the job done.

I'm trying to connect a desktop client to a WordPress blog using this library. After making some changes to the check_oauth_signature function I was able to get the URL to open in a web browser so that the user could log in and grant access to my application.

When attempting to redirect the browser reported the error "The callback URL is invalid". In the handle_callback_redirect function the following validation is applied to $callback:

$callback = wp_http_validate_url( $callback );

This validation is problematic for desktop applications. A desktop application has three approaches to using OAuth:

1. Designate a custom URL protocol that the browser passes off to the desktop application (e.g. myapp://)
2. Listen on a port of the localhost (e.g. 127.0.0.0:9999)
3. Perform the whole operation within a browser hosted in the desktop application and intercept the callback URL.

(3) never made sense to me as the user has no way of ensuring that you are indeed sending them to the right website.

I've used (1) and (2) in the past. I use (1) with the OAuth implementations for Dropbox and Evernote.

The issue here is that the OAuth1 code thinks that 127.0.0.1:9999 is an invalid URL. wp_http_validate_url() seems overly strict for the purposes of an OAuth callback URL. I know some services with only allow "http" prefixed URLs or they make you register the callback URL with the service.

I own site and i created an official android app for the same site... now i want the users to be able to login with simply username and password (no prompting of authorize screen)... i read its in OAuth2 ...but i dont know how to implement it with Oauth1.0a plugin...?? help???

get_parameters() is still ignoring extra post data parameters sent as application/json.
Is this on purpose?

When merging all $_GET and $_POST parameters, along with Authorization headers, since PHP 5.6 data sent as application/json is ignored in $_POST, so we need to also collect parameters from posted JSON data using php://input

After line 93 of class-wp-json-authentication-oauth1.php

// ... 
        $params = array_merge( $_GET, $_POST );
        $params = wp_unslash( $params );

        if($_SERVER['CONTENT_TYPE']=='application/json'){
            $raw_post_data_params = json_decode(file_get_contents('php://input'), true);
            if ( ! empty( $raw_post_data_params ) ) {
                $raw_post_data_params = wp_unslash( $raw_post_data_params );
                $params = array_merge( $params, $raw_post_data_params );
                ksort($params);
            }
        }

// .....

This fixed my Missing OAuth parameter oauth_verifier error.

Now, I can finally connect a client to my server and get an access_token for its user, since my OAuth client was sending the oauth_verifier as application/json. (And likely to interact with the API in this way for all other POST requests).

I have also successfully tested creating a new post with my newly acquired access_token/secret after making these changes, when sending the data as application/json.

One thing, however... the OAuth1.0a signing requests spec does state:

The request parameters are collected, sorted and concatenated into a normalized string: Parameters in the OAuth HTTP Authorization header excluding the realm parameter. Parameters in the HTTP POST request body (with a content-type of application/x-www-form-urlencoded). HTTP GET parameters added to the URLs in the query part (as defined by [RFC3986] section 3).

note: "(with a content-type of application/x-www-form-urlencoded)"

but this ignores the PHP5.6+ issue when sending applicaton/json formatted data.

also note: When I tested uploading a media file, I found I needed to use : multipart/form-data (in a PHP cUrl request)

I am getting "Could not locate API; are you sure it's enabled?" when I try to link client to WordPress. I have installed all necessary plugins and dependencies are installed & activated including (WP-REST API, oAuth1 etc). When I try HEAD http://mywebsitelink it returns link with wp-json which indicates WP-API is working. Also, when I try wp oauth1 add, it works fine and generates key and secret. Any suggestion on how to fix this issue? Thanks in advance.

From a JS client I get the following message on oauth1/request:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8080' is therefore not allowed access. The response had HTTP status code 400.

You might want to copy this function from the WP-API:

function rest_send_cors_headers( $value ) {
    $origin = get_http_origin();

    if ( $origin ) {
        header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
        header( 'Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE' );
        header( 'Access-Control-Allow-Credentials: true' );
    }

    return $value;
}

I'm running into an issue with programming a hashed signature that works with the system.

Here is what I know:

• The Oauth server has been installed and is working properly
• I have successfully generated a shared token/secret through the 3-leg authorization process using Postman.
• I am able to submit a signed request and get a valid response from my install including JSON data in the request body, using postman,

So I know the system works.

Now, because I'm trying to automate a client to communicate with my server, I need to automatically timestamp and sign the requests, so I am generating a request using PHP and sending it with CURL.

Here's the code (and yeah, it's likely quite messy as I'm still in the beating-head-on-desk phase of development here)...

// These two values identify the application (on dev.StevenBritton.net)

	$consumerKey = "consumer-key";
	$consumerSecret ="consumer-secret";

	// These two values are the client's individual long-term credentials.

	$oToken = "client-token"
	$oSecret = "client-secret";

	// Nonce to assign to the signature

        //add_filter( 'nonce_life', function() { return 300;} );  // I had this because I wanted short-lived nonces.
	$timeStamp = time();
	$nonce = wp_create_nonce($timeStamp); // Not really sure what I should pass to this here...
        //remove_filter( 'nonce_life',function() { return 300;});

       // urlencode everything.  I'll clean this up a bit later...
       $base_method = urlencode('POST');
       $base_url = urlencode('http://dev.stevenbritton.net/wp-json/custom/path/that/works');
       $oauthConsumerKey = urlencode('oauth_consumer_key='.$consumerKey);
       $oauthNonce = urlencode('oauth_nonce='.$nonce);
       $oauthSignatureMethod = urlencode('oauth_signature_method=HMAC-SHA1');
       $oauthTimestamp = urlencode('oauth_timestamp='.$timeStamp);
       $oauthToken = urlencode('oauth_token='.$oToken);
       
       $sigBase = $base_method . '&' . $base_url . '&' . $oauthConsumerKey . '&'. $oauthNonce . '&'.$oauthSignatureMethod.'&'.$oauthTimestamp.'&'.$oauthToken;
       $keyBase = $consumerSecret . '&' . $oSecret;
       
// Here's the line that generates the signature...

       $signature = hash_hmac('sha1',$sigBase,$keyBase);

//  Build the CURL request:
$url = "http://dev.stevenbritton.net/wp-json/stevenBritton/licenseMe/v1/single?" . urlencode($auth_string);

$curl = curl_init();


	curl_setopt_array($curl, array(
	CURLOPT_URL => $url,
	CURLOPT_RETURNTRANSFER => true,
	CURLOPT_ENCODING => "",
	CURLOPT_MAXREDIRS => 10,
	CURLOPT_TIMEOUT => 30,
	CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
	CURLOPT_CUSTOMREQUEST => "POST",
	CURLOPT_HTTPHEADER => array(
	  "authorization: OAuth oauth_consumer_key=\"" . $consumerKey . "\",oauth_token=\"" . $oToken . "\",oauth_signature_method=\"HMAC-SHA1\",oauth_timestamp=\"" . $timeStamp . "\",oauth_nonce=\"" . $nonce . "\",oauth_signature=\"" . $signature . "\"",
	  "cache-control: no-cache",
	  "content-type: application/json"
	),
));
       curl_setopt($curl, CURLOPT_POSTFIELDS, $json);

       $response = curl_exec($curl); // <-- craps out.  Every time I get "signature does not match"
       $err = curl_error($curl);

       curl_close($curl);

       if ($err) {
         echo "cURL Error #:" . $err;
       } else {
         echo $response;
       }

So, here's the question:

What am I doing differently than the OAuth machine that is causing my signature to mismatch the verification, when Postman does it correctly?

When I hit domain.com/blog/oauth/request with a simple GET, I get 'No Oauth parameters supplied'

I downloaded: https://github.com/WP-API/example-client and fired it up. Discovery worked fine, I put in my credentials and still receive the same error:

any suggestions would be greatly appreciated.

After switching from PHP 7.4 to 8.0 a warning is thrown:

[16-Dec-2020 10:43:09 UTC] PHP Warning: WP_REST_OAuth1::normalize_parameters(): Argument #2 ($value) must be passed by reference, value given in /.../wp-content/plugins/rest-api-oauth1/lib/class-wp-rest-oauth1.php on line 672

Hello,

Currently, when I run this function get_current_user_id() it returns current authenticated user data like We have used header authorization. Please check below link.

http://prntscr.com/luhp1v

if we have call login API, then we want to get this login user ID with get_current_user_id()

We have generated this OAuth keys with main administrator user User id 1 now using this key when we call any API we want get_current_user_id() function will return the user ID which we want, like what we need to do with login API or every API call how we can pass parameters which set user.

Thanks

Hi there,i am facing the ionic cors issue and i also create a proxy for that,update my ".htaccess" file but if dones not work.Please help me

All the other steps in the tutorials work for me (oauth1/request, oauth1/authorize) but when I try to get a permanent access token, all I get back is an HTML response with 200 OK.

If I'm missing an oauth parameter then I get an error as expected, but if everything in my request is correct, I get back the index page rather than an application/x-www-form-urlencoded list like expected.

I ran this, the top one comes back a 200, the bottom one always a 404 saying "missing parameter oauth_token. Any ideas on what I can check? I have been going through the forums and posts for hours now, trying different configs within nginx, etc. I am at a loss now. (the keys and site were, of course, changed on purpose. Everything is as it should be)

    para0 = {
                'name':'Verifier',
                'consumer_key':'kl****K79Got6',
                'consumer_secret':'B9******boKvvEd1IIvV87ZfaPJ3oeBO91kzVp6X48c6a3Bw',
                'request_token_url':'https://mysite/oauth1/token',
                'access_token_url':'https://mysite/oauth1/access',
                'authorize_url':'https://mysite/oauth/authorize',
                'base_url':'https://mysite'}
    
    para1 = OAuth1Service(
                name='Verifier',
                consumer_key='kl5*****9Got6',
                consumer_secret='B992qbFS**********7ZfaPJ3oeBO91kzVp6X48c6a3Bw',
                request_token_url='https://mysite/oauth1/token',
                access_token_url='https://mysite/oauth1/access',
                authorize_url='https://mysite/oauth/authorize',
                base_url='https://mysite')
    
    
    r = requests.get('http://mysite/oauth1/authorize', params=para0)
    print(r.text)
    oauth_token, oauth_token_secret = para1.get_request_token()
    print(oauth_token, oauth_token_secret)

It is strange, I can't get to Oauth1 from postman, but I can get to 2.

Hello! I currently have WP OAuth Server 1.0a on a number of client WP installations, and it has worked wonderfully so far. I really appreciate the great work on this plugin!

I wanted to raise as an issue the current status of this plugin on the WP plugin site: https://wordpress.org/plugins/rest-api-oauth1/

The current status is:

This plugin hasn’t been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.

This has become something of a deterrent for new clients that we are trying to integrate, as they believe it is no longer a secure plugin. I'm not sure if there is a plan to validate the plugin against the most recent versions, or if there is any way I could even help with that. If so, please let me know as I'd like to keep using this plugin.

Thanks! Eric