Automattic\WooCommerce\Internal\PushNotifications\Controllers

PushNotificationRestController::authorize │ public │ WC 10.7.0

Validates the JWT from the Authorization header, falling back to the token query parameter on hosts that strip the header before it reaches PHP (see {@see InternalNotificationDispatcher::TOKEN_QUERY_PARAM}).

Method of the class: PushNotificationRestController{}

No Hooks.

Returns

true|WP_Error.

Usage

$PushNotificationRestController = new PushNotificationRestController();
$PushNotificationRestController->authorize( $request );

$request(WP_REST_Request) (required)

The request object.

Changelog

PushNotificationRestController::authorize() PushNotificationRestController::authorize code ^{WC 11.2.1}

public function authorize( WP_REST_Request $request ) {
	$header = trim( (string) $request->get_header( 'authorization' ) );

	if ( '' !== $header ) {
		$token = strncasecmp( $header, 'Bearer ', 7 ) === 0 ? substr( $header, 7 ) : $header;
	} else {
		$token = $this->get_token_from_query( $request );
	}

	if ( '' === $token ) {
		return new WP_Error(
			'woocommerce_rest_unauthorized',
			'Missing credential: no Authorization header and no token query parameter.',
			array( 'status' => WP_Http::UNAUTHORIZED )
		);
	}

	if ( ! JsonWebToken::validate( $token, wp_salt( 'auth' ) ) ) {
		return new WP_Error(
			'woocommerce_rest_unauthorized',
			'Invalid or expired token.',
			array( 'status' => WP_Http::UNAUTHORIZED )
		);
	}

	$parts = JsonWebToken::get_parts( $token );

	if ( ! isset( $parts->payload->iss ) || get_site_url() !== $parts->payload->iss ) {
		return new WP_Error(
			'woocommerce_rest_unauthorized',
			'Invalid token issuer.',
			array( 'status' => WP_Http::UNAUTHORIZED )
		);
	}

	$body_hash = hash( 'sha256', $request->get_body() );

	if ( ! isset( $parts->payload->body_hash ) || ! hash_equals( (string) $parts->payload->body_hash, $body_hash ) ) {
		return new WP_Error(
			'woocommerce_rest_unauthorized',
			'Body hash mismatch.',
			array( 'status' => WP_Http::UNAUTHORIZED )
		);
	}

	return true;
}