REST API Authentication: Cookie+Nonce vs. Application Passwords
WordPress's REST API (covered in an earlier article ) mixes two kinds of endpoints: some that anyone can read without authenticating, and others that reject you outright unless you're logged in. Inside wp-admin, the browser is quietly firing off requests to that same API the whole time you're editing — and yet you never re-enter your password for each one. This article looks at the mechanism…
WordPress's REST API authentication employs two distinct methods: cookie+nonce for wp-admin requests and Application Passwords for external programs. When a user logs into WordPress, the browser receives an authentication cookie named wordpress_logged_in_*. Subsequent requests to the REST API, such as auto-saving drafts or updating posts in the block editor, automatically carry this cookie.
However, cookies alone are insufficient to prevent CSRF attacks, as they are automatically sent with every request. To address this, a nonce token is generated for the current session and included in the X-WP-Nonce header of write requests. The nonce verifies that the request originates from the same logged-in user and page, ensuring it was intended by that user.
While this cookie+nonce system effectively mitigates CSRF threats, it is not compatible with external programs, as cookies are tied to browser sessions and cannot be easily obtained or maintained by non-browser applications. Application Passwords, introduced in WordPress core version 5.6, provide an alternative authentication method for external programs.
Users can generate a unique Application Password for an application from their profile page, which functions similarly to HTTP Basic authentication. This password is distinct from the user's login password and carries the same permissions. Unlike cookies, Application Passwords do not rely on browser session state, allowing external programs immediate access once generated.
Moreover, each Application Password can be individually revoked, providing fine-grained control over permissions without affecting other credentials. Notably, some API endpoints, such as the read-only /wp/v2/posts endpoint for public posts, do not require any authentication, illustrating the layered approach to WordPress REST API security.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
