Protect Endpoints bug with Whitelisted and Protected endpoints about simple-jwt-login

[canonex]

I confirm.

I use apache userdir and my address is:
https://mydomain.net/~me/mywordpress

So, a possible route is
https://mydomain.net/~me/mywordpress/wp-json/xx/v1/endpoint

At this time only the domain is considered and not the siteurl or home as written in the db options.

The comparison fails, as stripping out the wp-json is equal comparing:
~me/mywordpress/wp-json/xx/v1/endpoint
and
~me/mywordpress/xx/v1/endpoint
which is therefore always false.

So I commented out the line:
//$protectedEndpoint = $this->removeWpJsonFromEndpoint($protectedEndpoint);
and inserted in the ui in "Protected endpoints" the complete path
/~me/mywordpress/wp-json/xx/v1/endpoint
and it works correctly.

It would be useful to have the full flow by removing not only the domain but the whole siteurl.
In this way you could simply insert
/wp-json/xx/v1/endpoint

Thank you,
Rickyx

ps. how to retrieve the user id from the authorized endpoint?

[nicumicle]

Hello @canonex @psusu

I did some fixes for this.

Can you please check on your side and let me know if it is working ok for you?

[canonex]

I'm sorry, I tried several options but I can't figure out what should I write in the Protected endpoints (using Apply only on Specific REST endpoints option) if I want to protect this endpoint:
https://mydomain.net/~me/mywordpress/wp-json/xx/v1/endpoint

Thank you,
Riccardo

[nicumicle]

Hello @canonex,

In the protect endpoints, you neet to add

• /wp-json/xx/v1/endpoint