-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Installing Duo Universal blocks Woocommerce /wp-json/wc/v3/ endpoint #63
Comments
Turns out this was just due to Duo not being setup correctly. |
This actually wasn't a misconfiguration issue, I only thought it was fixed because I was able to get around the issue while I was logged in. So Duo is blocking Woocommerce endpoints for non-logged in users. |
Thanks for reporting this! Digging into this, the issue is that WooCommerce REST API keys are directly tied to specific user accounts, and if that user account is configured to require Duo 2FA, then that API Key will also require 2FA, which is why it redirects to the login page (and therefore shows the login page HTML when the REST endpoint is access via ajax). The Duo plugin has a setting to toggle on/off 2FA requirements for individual roles. One potential workaround may to be disable 2FA for a specific role, create a single user with that role, and generate the REST API key linked to that user account. One challenge might be finding a role which has the capabilities WooCommerce requires, without being too permissive and reducing your overall security. This section of the documentation https://woocommerce.com/document/roles-capabilities/#section-3 mentions a few plugins capable of adding/modifying roles. It may be possible to create a new role specifically for this purpose, and give it the exact capabilities required. |
After installing the Duo Universal plugin, a major feature of a website no longer works because product data cannot be returned
Description
ajax requests to product endpoints return
'<', "<!DOCTYPE "... is not valid JSON
errorsthis endpoint is being redirected to the login screen '/wp-json/wc/v3/products?category=' + id + '&consumer_key=' + consumer_key + '&consumer_secret=' + consumer_secret + '&orderby=title&order=asc',
Expected Behavior
Should return a list a products with a given category id
Actual Behavior
Returns the HTML of the login page instead of JSON product data
Steps to Reproduce
Visit a url like this https://example.com/wp-json/wc/v3/products?category=39&consumer_key=consumer_key_value&consumer_secret=consumer_secret_value and get redirected to the wordpress login page
Workarounds
Currently no workaround.
This seems like a major issue.
The text was updated successfully, but these errors were encountered: