jwt_auth_no_auth_header error on validating WordPress REST API JWT token

Question

I have two AWS instances, one for WordPress website and another for React application. To connect them together I am using "WP REST API - OAuth 1.0a Server" and "JWT Authentication for WP-API" for accessing WP REST API.

I am able to generate token by /wp-json/jwt-auth/v1/token but when I am trying to access any other endpoint or if trying to validate the token by /wp-json/jwt-auth/v1/token/validate I am getting following error :

{
  "code": "jwt_auth_no_auth_header",
  "message": "Authorization header not found.",
  "data": {
    "status": 403
  }
}

I looked up and found few things to add to .htaccess. I added everything I could find but had no success.

RewriteEngine On
RewriteBase /

# Enable HTTP Auth
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

# WordPress
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# For SetEnvIf Authorization
#RewriteRule (.*) - [env=myenv:1]
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
#SetEnvIf Authorization .+ HTTP_AUTHORIZATION=$0

I added following code to see if any Authorization Header is present in the request but there isn't any

add_filter( 'rest_pre_dispatch', 'prefix_show_request_headers', 10, 3 );
function prefix_show_request_headers( $result, $server, $request ) {
    $result = $request->get_headers();
    return $result;
}

Here (https://github.com/Tmeister/wp-api-jwt-auth/issues/6) I read that WordPress is maybe trying to authenticate via cookie method by default and is throwing error and not reaching JWT authentication so I added this piece of code but still no success

add_filter( 'rest_authentication_errors', '__return_true' );

At last I added "JSON Basic Authentication" plugin which also sends username:password in the Headers and it works. So I am not sure if it's an issue with Headers being stripped. As it is not recommended for production server so I need JWT authentication to work.

Any help is appreciated.

Marcos · Accepted Answer · 2018-02-04 04:43:46Z

22

I was facing the same problem, until i change the order of lines on my htaccess. Initially,i put the lines

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

at the end of the rules.

After those lines where only after the RewriteEngine On, the error jwt_auth_no_auth_header was fixed. On jwt authentication for wp rest api

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

answered Feb 4, 2018 at 4:43

Marcos

2212 silver badges3 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Alok Rajasukumaran Over a year ago

This works but WordPress is automatically modifying my htacces

saber tabatabaee yazdi Over a year ago

thats great save my day. thanks you. i did it many times and hadn't knowledge about this important configuration

Akash Joshi · Accepted Answer · 2018-01-01 09:27:40Z

13

In case someone else faces this issue, this code that I added to .htaccess is probably not working

# Enable HTTP Auth
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

So in the plugin file jwt-authentication-for-wp-rest-api/class-jwt-auth-public.php, look in the function named validate_token, after the $auth check fails I added this piece of code :

if (!$auth) {
    $allHeaders = getallheaders();
    $auth = isset($allHeaders['Authorization']) ? $allHeaders['Authorization'] : false;
}

This will get that Authorization header and JWT will work as expected

edited Jan 1, 2018 at 9:27

answered Jun 8, 2017 at 19:22

Akash Joshi

6181 gold badge6 silver badges16 bronze badges

3 Comments

Steve Kim Over a year ago

This helped me a lot. To avoid undefined index error, you can do the following: $auth = isset($allHeaders['AUTHORIZATION']) ? $allHeaders['AUTHORIZATION'] : false;

Akash Joshi Over a year ago

Thanks @steveKim ! Updated answer.

user1298923 Over a year ago

Note that the getallheaders() function does not exist in Nginx, PHP-FPM or any other FastCGI method of running PHP. It can be pollyfilled. See stackoverflow.com/a/41427998/1298923

Digital Nomad · Accepted Answer · 2022-08-04 00:43:32Z

1

I tried all the mentioned above and did not succeed to make it work until I checked my installed plugins and I found that I have two plugins: one called "JWT Auth", and the other: "JWT authentication for WP-API". When I de-activated "JWT Auth" everything worked just fine. I don't know the reason, but it seems there is some kind of conflict between the two.

answered Aug 4, 2022 at 0:43

Digital Nomad

216 bronze badges

Comments

Leonardo Lopez · Accepted Answer · 2023-08-07 16:26:23Z

0

I can confirm that the plugin "JWT Auth" seems to have an issue. Instead, I installed "JWT Authentication for WP-API" and it worked like a charm

answered Aug 7, 2023 at 16:26

Leonardo Lopez

335 bronze badges

Collectives™ on Stack Overflow

jwt_auth_no_auth_header error on validating WordPress REST API JWT token

4 Answers 4

2 Comments

3 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related