Get current user inside register_rest_route method

Question

How to retrive wp_get_current_user() inside a register_rest_route callback (Wordpress site)?

I'm just trying to do a simple hello wp_get_current_user()->user_login on a php test page:

add_action('rest_api_init', 'helloTest');

function helloTest() {

    register_rest_route('hello', 'hello/(?P<id>\d+)', array(
        'methods' => WP_REST_SERVER::READABLE,
        'callback' => 'showHello'
    ));
}

function showHello($someVariable) {
    echo "Hello " . wp_get_current_user()->user_login . $someVariable;
}

But wp_get_current_user() is null and wp_get_current_user->ID is 0;

I dont want to authenticate the user again. I just want to retrieve his username. If he is not logged in, just show empty an empty string.

If I have to authenticate again, how to add a "nonce" to it? On internet I just have examples using javascript, but not directly on PHP methods.

Answer 1

Issues in your code

First off, you should understand properly how to add custom WP REST API endpoints:

1. An endpoint's namespace (the first parameter passed to register_rest_route()) should be in this format: your-plugin/v<version>. E.g. hello/v1 or hello-world/v1 and not just hello or hello-world.

2. $someVariable (the first parameter passed to your endpoint callback function) is not just any variable — it's an instance of the WP_REST_Request class — and shouldn't be echo-ed like what you did here:

   function showHello($someVariable) {
       echo "Hello " . wp_get_current_user()->user_login . $someVariable;
   }
   

   And normally, the $someVariable is better be changed to $request (i.e. rename it to "request").

3. And you should return a valid WP REST API response. For example, to return just the username:

   return new WP_REST_Response( wp_get_current_user()->user_login, 200 );
   

4. And know your own API endpoint URL..

   (based on your original namespace)
   /wp-json/hello/hello/1  <- correct
   /wp-json/hello/?John    <- incorrect
   

   because in your code, the parameter is a number and not string: (?P<id>\d+)

I hope those help you, and once again, do read the handbook for a more detailed guide.

The Corrected Code

add_action( 'rest_api_init', 'helloTest' );

function helloTest() {
    register_rest_route( 'hello/v1', 'hello/(?P<id>\d+)', array(
        'methods' => WP_REST_SERVER::READABLE,
        'callback' => 'showHello'
    ) );
}

function showHello( $request ) {
    return new WP_REST_Response( wp_get_current_user()->user_login, 200 );
}

Now about getting the user (from the API endpoint — showHello())

If I have to authenticate again, how to add a "nonce" to it?

Just because the user is logged-in/authenticated to the (WordPress) site, it doesn't mean the user is automatically logged-in to the WP REST API. So yes, you'd need to either provide a nonce along with your API request, or use one of the authentication plugins mentioned right here.

Now in most cases, GET (i.e. read-only) requests to the API do not need any authentication, but if you'd like to retrieve the data of the currently logged-in user on your site, then one way is via the _wpnonce data parameter (either POST data or in the query for GET requests).

Example for a GET request:

http://example.com/wp-json/wp/v2/posts?_wpnonce=<nonce>

So based on your comment and the corrected code (above):

Theres no "code" that make the request. Its is just an anchor that calls my route: <a href="site.com/wp-json/hello/?John">Hello</a>

You can add the nonce as part of the URL query string like so: (the namespace is hello/v1 and the <id> is 1)

// Make request to /wp-json/hello/v1/hello/<id>
$nonce = wp_create_nonce( 'wp_rest' );
echo '<a href="/wp-json/hello/v1/hello/1?_wpnonce=' . $nonce . '">Hello</a>';

So try that out along with the corrected code and let me know how it goes. :)

And once again, be sure to read the REST API authentication handbook.