A route with a permission callback that returned true for any logged-in user, on an endpoint that returned other people’s orders. The absence of a permission callback produces…
register_post_meta with show_in_rest exposes the field, and the default authorisation is more permissive than most people assume. A meta key beginning with an underscore is protected for the…
Hand-written validation in a REST callback, when the argument definition can do it and produce documentation at the same time. The argument schema validates before the callback runs,…
A public REST endpoint serving the same payload to everybody, hit forty thousand times a day, and generated forty thousand times. WordPress sends no-cache on REST responses by…
The component renders a dynamic block by asking the server, which means the editor preview is a network round trip for every attribute change. Without debouncing, typing a…
Custom authentication for the REST API hooks a filter that runs before most of WordPress is loaded, which constrains what is available inside it. Returning early when a…
Post meta is invisible to the block editor unless it is registered with a type and exposed to the REST API. show_in_rest makes it readable and writable by…
Authenticating a script against the REST API meant cookies and a nonce, which needs a browser, or a real password in a configuration file. Saying plainly that it…