Get data from Woocommerce via server api

orange

@d-healey Oh yes, .htaccess file and wp-config file must be modified.

Is customer purchase call working?
I am trying to get user info but response is "Sorry, you are not allowed to list users." I think same header issue is here too.

I am using live server by the way.

var encryptionData;
Server.setBaseURL("https://website.com");

inline function onGetInfo_ButtonControl(component, value)
{
   if(value)
      {
         local LockerPW = "987654321";
            
         local FileDirectory = FileSystem.getFolder(FileSystem.UserPresets).getParentDirectory();
         encryptionData = FileDirectory.getChildFile("credentials.dat").loadEncryptedObject(LockerPW);
                  
         Server.setHttpHeader("Authorization: Bearer " + encryptionData.token);
            
         Server.callWithGET("wp-json/wp/v2/users", encryptionData.user_email, function(status, response)
         {
            local serv_resp = trace(response);
           
            Console.print("server response: " + serv_resp);
         });
        
      }      
};
Content.getComponent("GetInfo_Button").setControlCallback(onGetInfo_ButtonControl);

d.healey

Yes I modified htaccess but it didn't work on my testing server - xampp. I had to do the extra steps I put in my last post.

Christoph Hart

Not sure if I understand this particular authentication system, but isn't the token supposed to be generated as a session cookie?

User logs in with credentials (email & password)
Server returns a token when the login succeeds (might return a cached token if the requests are within a certain time).
User uses this token for each subsequent URL request as proof of authentication (most likely in the header).

orange

@Christoph-Hart Yes token system is supposed to be generated as a session cookie.

Wordpress REST API can use this token system (JWT Auth)
Woocommerce REST API only uses OAuth system (consumer key and consumer secret codes method)

Do you think consumer key and consumer secret codes can be compromised by hackers on a compiled plugin?

orange

@d-healey said in Get data from Woocommerce via server api:

Yes I modified htaccess but it didn't work on my testing server - xampp. I had to do the extra steps I put in my last post.

I applied that steps but my server system doesn't accept http header authenticaton. Keep digging...

Lindon

@orange said in Get data from Woocommerce via server api:

@Christoph-Hart Yes token system is supposed to be generated as a session cookie.

Wordpress REST API can use this token system (JWT Auth)
Woocommerce REST API only uses OAuth system (consumer key and consumer secret codes method)

Do you think consumer key and consumer secret codes can be compromised by hackers on a compiled plugin?

isn't

consumer key = user ID/email address
consumer secret code = password

?

orange

@Lindon said in Get data from Woocommerce via server api:

@orange said in Get data from Woocommerce via server api:

@Christoph-Hart Yes token system is supposed to be generated as a session cookie.

Wordpress REST API can use this token system (JWT Auth)
Woocommerce REST API only uses OAuth system (consumer key and consumer secret codes method)

Do you think consumer key and consumer secret codes can be compromised by hackers on a compiled plugin?

isn't

consumer key = user ID/email address
consumer secret code = password

?

Woocommerce doesn't alow to use it's REST API with directly using username and passwords while authentication. These two codes are generated within Woocommerce > Settings > Advanced > REST API > Add Key menu.

So your app will use these codes to use Woo REST API. You can give permissions Read, Write or both depending on your needs.

WooCommerce REST API Documentation - WP REST API v3

(woocommerce.github.io)

Christoph Hart

@orange said in Get data from Woocommerce via server api:

Yes token system is supposed to be generated as a session cookie.

Then why do you save it in a file?

Do you think consumer key and consumer secret codes can be compromised by hackers on a compiled plugin?

Anything can be compromised. Things that are embedded in the plugin (RSA keys, static passwords in a script) can be extracted more easily than dynamic data that comes from the server (eg. these tokens), but then both things might be trivially easy for anybody with a good knowledge of reverse-debugging.

orange

@Christoph-Hart said in Get data from Woocommerce via server api:

@orange said in Get data from Woocommerce via server api:

Yes token system is supposed to be generated as a session cookie.

Then why do you save it in a file?

I just wanted to decrease server access, did it for multi instance uses especially. Also I didn't want to store password directly.
For example checking it once a day?
If the token is expired, it will pick a new one by the way.

But maybe there is a better idea?

d.healey

@Christoph-Hart said in Get data from Woocommerce via server api:

Not sure if I understand this particular authentication system, but isn't the token supposed to be generated as a session cookie?

User logs in with credentials (email & password)

Server returns a token when the login succeeds (might return a cached token if the requests are within a certain time).

User uses this token for each subsequent URL request as proof of authentication (most likely in the header).

Yes, but it doesn't need to be saved as a cookie, you can just save it in a variable and pass it in the header with each request. I have this working now in HISE. The problem was a server configuration issue, HISE is fine :)

@orange said in Get data from Woocommerce via server api:

But maybe there is a better idea?

Probably no harm in generating one for each request, unless you think the user is going to be making lots of requests. I'll probably store mine in a file that will expire each day.

orange

@d-healey said in Get data from Woocommerce via server api:

Probably no harm in generating one for each request, unless you think the user is going to be making lots of requests. I'll probably store mine in a file that will expire each day.

Which method can be used for each day expiration?

d.healey

@orange You can add a timestamp inside your encrypted file and compare it to the current time when you read the file.

d.healey

Ooo fancy stuff in the latest commit...

downloads are persistent when recompiling

What does this mean?

Christoph Hart

The Server class was owned by the scripting engine so when you recompile it will create a new server class and all downloads are gone. This was bad and now the server class has the same lifetime as the plugin itself.

d.healey

@Christoph-Hart Excellent!

d.healey

@Christoph-Hart Compile errors unfortunately

../../../../../HISE/hi_components/floating_layout/FloatingTileFactoryMethods.cpp:358:43: error: ‘web’ is not a member of ‘MainToolbarIcons’
   path.loadPathFromData(MainToolbarIcons::web, sizeof(MainToolbarIcons::web));
                                           ^~~
../../../../../HISE/hi_components/floating_layout/FloatingTileFactoryMethods.cpp:358:73: error: ‘web’ is not a member of ‘MainToolbarIcons’
   path.loadPathFromData(MainToolbarIcons::web, sizeof(MainToolbarIcons::web));

Christoph Hart

Ah yes I forgot to commit this file. You can just comment these lines out, it shouldn't affect anything.

d.healey

@Christoph-Hart Yep that worked. This server controller looks useful. Going to play around with it now.

d.healey

@orange Have you had any luck getting user order data through JWT authorization? WooCommerce seems to block any user that isn't an admin.

I think we may be forced to use the consumer/secret key thingy!

orange

@d-healey said in Get data from Woocommerce via server api:

@orange Have you had any luck getting user order data through JWT authorization? WooCommerce seems to block any user that isn't an admin.

Not yet, I tried lot's of thing but interestingly my server doesn't allow http header auth...

I think we may be forced to use the consumer/secret key thingy!

Yes it seems like that then. By the way don't forget to delete Server.setHttpHeader, because in this case woocommerce is blocking.

Get data from Woocommerce via server api

WooCommerce REST API Documentation - WP REST API v3

28

1.7k

11.8k

102.4k