Skip to content

Incorrect user capabilities result in unexpected 401 responses from the REST API #1611

Open
@dcalhoun

Description

@dcalhoun

When querying the REST API with successful authentication, endpoints return unexpected 401 response statuses. It appears the user's capabilities are not accurately portrayed in the context of WordPress Playground.

I discovered this issue while using curl to query a site running with the Studio app, but I also reproduced the issue using wp-now. Contrastingly, performing the following steps with a site running with wp-env result in the expected outcome.

Steps to Reproduce

  1. Start a Playground-powered site: npx @wp-now/wp-now start
  2. Modify the site's ~/.wp-now/wordpress-versions/latest/wp-config.php to set the environment to local: define('WP_ENVIRONMENT_TYPE', 'local');
  3. Visit the site's WP Admin and navigate to UsersEdit (the admin user).
  4. Create and copy an application password.
  5. Create and copy a Base64 version of the combined username and application password: echo -n 'admin:<application_password>' | base64 | pbcopy
  6. Generate a curl request for the block types endpoint: curl --header "Authorization: Basic <base64_string>" -L http://localhost:<port>/?rest_route=/wp/v2/block-types

Expected Outcome

A 200 response containing the site's block types is returned.

Actual Outcome

A 401 response is returned:

{
  "code": "rest_block_type_cannot_view",
  "message": "Sorry, you are not allowed to manage block types.",
  "data": { "status": 401 }
}

Metadata

Metadata

Assignees

Labels

[Type] BugAn existing feature does not function as intended

Type

No type

Projects

  • Status

    Backlog

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions