{"action":"closed","issue":{"url":"https://api.github.com/repos/WP-API/WP-API/issues/1821","labels_url":"https://api.github.com/repos/WP-API/WP-API/issues/1821/labels{/name}","comments_url":"https://api.github.com/repos/WP-API/WP-API/issues/1821/comments","events_url":"https://api.github.com/repos/WP-API/WP-API/issues/1821/events","html_url":"https://github.com/WP-API/WP-API/issues/1821","id":121326331,"number":1821,"title":"getting forbidden message while being logged in as admin","user":{"login":"tdapper","id":6338927,"avatar_url":"https://avatars.githubusercontent.com/u/6338927?v=3","gravatar_id":"","url":"https://api.github.com/users/tdapper","html_url":"https://github.com/tdapper","followers_url":"https://api.github.com/users/tdapper/followers","following_url":"https://api.github.com/users/tdapper/following{/other_user}","gists_url":"https://api.github.com/users/tdapper/gists{/gist_id}","starred_url":"https://api.github.com/users/tdapper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tdapper/subscriptions","organizations_url":"https://api.github.com/users/tdapper/orgs","repos_url":"https://api.github.com/users/tdapper/repos","events_url":"https://api.github.com/users/tdapper/events{/privacy}","received_events_url":"https://api.github.com/users/tdapper/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/WP-API/WP-API/labels/Support","name":"Support","color":"fef2c0"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-09T20:00:56Z","updated_at":"2015-12-28T15:06:18Z","closed_at":"2015-12-28T15:06:18Z","body":"I'm currently using the Basic Auth authorization plugin (I know it is discouraged, but I'm working in an environment where the full Basic Auth flow isn't feasible to implement).\r\n\r\nAt first I had server configuration problems where the authentication headers weren't passed through to PHP, but those were solved. At least I assume that, because when querying the\r\n\r\n`wp-json/wp/v2/users/me`\r\n\r\nendpoint, I'm getting proper information about me.\r\n\r\nThe user I am logging in as has admin rights, so I should be allowed to do pretty much everything. However, when trying to read a privately published post by accessing its post endpoint like this\r\n\r\n`wp-json/wp/v2/posts/88556`\r\n\r\nI'm getting a 403 forbidden error. This similarly appears to happen with other attempts that require user privileges beyond that of a regular user that isn't logged in. I also tried to explicitly include private posts in the filter rules (filter[post_status]=publish,private) both for the direct access to the posting as well as when accessing:\r\n\r\n`wp-json/wp/v2/posts`\r\n\r\nI faintly remember having found an article on the web that claimed there was a problem like this where the basic auth was checked first, then the regular auth overwrote the privileges again because no nonce was passen. However, I abandoned the article when I solved the configuration problem (assuming that was my only problem) and did not yet find it again. \r\n\r\n@rmccue asked my to post this here instead of with the basic auth plugin. You can find the original thread here: https://github.com/WP-API/Basic-Auth/issues/21#issuecomment-162119178"}}