Connect WP with backends over HTTP.

What's this pluggin for?

This plugin connects WordPress with backends in a bidirectional way. The idea behind the plugin is to allow CRUD (create, read, update, and delete) operations between the two realms.

How does it work?

The plugin offers a high level API to perform HTTP requests from WordPress, as well as, a bearer authentication system based on JWT to allow remote source control of the WordPress instance over its REST API.

The other core feature offered by the plugin is the backends setting with which you can configure multiple backend connections to connect with and reuse in your instance. Each backend can be configured with a set of default headers to perform authentication against the remote server over the HTTP protocol.

Bearer authentication extends the WP user system. This means that the backend should know some login credentials to generate access tokens. If your are concerned about security about this login mechanism, you can create custom roles to assign to your backend user to limit its capabilities.

Installation

Download the latest release as a zipfile. Once downloaded, go to your site plugins page and upload the zip file as a new plugin, WordPress will handle the rest.

Go to the releases to find previous versions.

If you have access to a console on your server, you can install it with wp-cli with the next command:

wp plugin install https://git.coopdevs.org/codeccoop/wp/plugins/bridges/http-bridge/-/releases/permalink/latest/downloads/plugins/bridges/http-bridge.zip

Getting started

See install section to learn how to install the plugin. Once installed, go to Settings > Http Bridge to configure your backend connections. The settings page has two main sections:

1. General
   • Whitelist backends: Controls if HTTP Bridge should block incomming connections to the wp-bridges REST API namespace from other sources than the listed on de backends setting.
   • Backends: List of configured backend connections. Each backend needs a unique name, a base URL, and, optional, a map of HTTP headers.

HTTP requests

Http Bridge offers a high level API to perform HTTP requests from WordPress with four methods: http_bridge_get, http_bridge_post, http_bridge_put and http_bridge_delete.

See the documentation for more information about the API.

Content types

When using some HTTP method that supports body on the request (POST and PUT), Http Bridge will try to encode its content for you. You can control how Http Bridge encode your data on the body with the header Content-Type. If this header isn't present, Http Bridge will encode your data as JSON string. Supported content types are application/json, application/x-www-form-urlencoded and multipart/form-data.

If your requests needs to transfer files, Http Bridge will switch to the multipart/form-data encoding schema, the only that supports binary data transfers.

If you want to use some other encoding schema, you should encode your data and transform it to string before pass it to Http Bridge. When the data comes in form of a string, Http Bridge skips the encoding step and pass them away as the body of the request.

GET and DELETE methods doesn't support request body, so your data will be encoded as application/x-www-form-urlencoded and appended to your URL as query params.

Backends

Http Bridge can be configured with many backend connexions to handle HTTP requests.

Each backend connexion needs a unique name that identifies it and a base URL. The base URL will be prepended to your form hook endpoints to build the URLs from the backend HTTP API. To each backend you can set a collection of HTTP headers to be sent on each request. In addition, Http Bridge will add some default headers to the request.

Using backends objects as agents to perform HTTP requests it's an easey way to reuse code and configuration across your multiple connexions.

Backend's content type HTTP header will drive how Http Bridge works in the same way as it do with the plain HTTP methods explained before.

Authorization

Write operations over the WP REST API are protected with authentication. At the same time, there is not a standard method to authenticate clients over the standard REST API. To fill this gap, Http Bridge exposes a couple of endpoints to gain access to the WP via REST API on top of JWT and the Bearer Authentication schema. Go to the documentation for more information.

Auth secret

To be able to cryptographicaly sign the JWT, HTTP Bridge needs a secret. This secret should be defined as a const on your code as HTTP_BRIDGE_AUTH_SECRET. If you don't define it, Http Bridge will work with its default value, but you are exposed to security issues. Please, don't do this on production environments!!.

Developers

The plugin offers some hooks to expose its internal API. Go to API to see more details about the hooks, or to REST API to see its endpoints.

Local development

The repository handles dependencies as git submodules. In order to work local, you have to clone this repository and initialize its submodules with this command:

git submodule sync
git submodule update --init

Once done, you will need to install frontend dependencies with npm install. To build the admin's react client, run npm run dev for development, or npm run build for production builts.

We work WordPress with docker. See our development setup if you are interested.