Wordpress插件和访问wp-json API

Question

Wondering if someone can provide some direction.

I'm creating a Wordpress plugin that will be publicly available (free). The plugin is meant to allow bloggers to include a definition widget using bootstrap's data-toggle.

Since I don't want people stealing the content without attribution, the hyperlink will be pulled out from a private API.

Here's how I think this should flow, but I know that there are things that are inefficient:

• Create a private API that houses all of the data. It might be as 3 branches of data:

  id -- name -- definition

• Have the plugin authenticate somehow with the server

• Plugin creates a shortcode in Wordpress ie. [define="term"]anchor[/define]

• When the shortcode is called, it pings the server and stores something locally in their sql db.

Additional Notes/Concerns

I understand that there is nothing such as being hack-free or altered free. But I want to get as close as possible.

A couple exploits I can see happening is if people change the cached info in the SQL DB. Is there a way to potentially kill the data-toggle content if this happens?

Also, I don't want people to be able to create their own calls to our API creating their own programs. That's not the intended use of this.

I apologize if my thoughts seem cluttered, but I can't seem to figure out a solid workflow in where I should get started with this.

If anyone can help bring clarity, I would greatly appreciate it.

Answer 1

I would be inclined to do the following:

• Give every user a unique API token or other credentials
• Link every token to a single IP address and reject any requests where the token doesn't match the IP address.

That way if you become aware of someone misusing the content you need only delete their token to prevent access, and can be reasonably sure that it's not being used on another server. Users can enter the API credentials in the plugin admin.

I think OAuth2 will probably be the way to go to authenticate clients - it's made for granting access to client applications and there are plenty of implementations available. You'd need to add the ability to verify that the user matches the IP, but that shouldn't be difficult.