← All changes
|
public/modules/api/class-access-token-api-controller.php
+10
-6
11.3.61
→
11.3.75
View file →
| @@ -56,14 +56,18 @@ | ||
| 56 | 56 | ); |
| 57 | 57 | } |
| 58 | 58 | |
| 59 | 59 | // Server-side exchange — refresh token never leaves PHP. |
| 60 | - // The /wordpress/v1/oauth/refresh endpoint takes the token as a query | |
| 61 | - // parameter (consistent with the existing browser-side JS client contract). | |
| 62 | - $api_url = Filters::apply_base_api_url_filters() . '/wordpress/v1/oauth/refresh'; | |
| 60 | + // The /wordpress/v2/oauth/refresh endpoint takes the token in the POST | |
| 61 | + // body so it does not appear in server access logs. | |
| 62 | + $api_url = Filters::apply_base_api_url_filters() . '/wordpress/v2/oauth/refresh'; | |
| 63 | 63 | $response = wp_remote_post( |
| 64 | - $api_url . '?refresh_token=' . rawurlencode( $refresh_token ), | |
| 65 | - array( 'timeout' => 15 ) | |
| 64 | + $api_url, | |
| 65 | + array( | |
| 66 | + 'headers' => array( 'Content-Type' => 'application/json' ), | |
| 67 | + 'body' => json_encode( array( 'refreshToken' => $refresh_token ) ), | |
| 68 | + 'timeout' => 15, | |
| 69 | + ) | |
| 66 | 70 | ); |
| 67 | 71 | |
| 68 | 72 | if ( is_wp_error( $response ) ) { |
| 69 | 73 | return new \WP_REST_Response( |
| @@ -103,9 +107,9 @@ | ||
| 103 | 107 | $cache_data = json_encode( |
| 104 | 108 | array( |
| 105 | 109 | 'accessToken' => $body['access_token'], |
| 106 | 110 | 'expiresAt' => time() + $expires_in, |
| 107 | - ) | |
| 111 | + ) | |
| 108 | 112 | ); |
| 109 | 113 | set_transient( self::CACHE_KEY, $cache_data, $expires_in - 300 ); |
| 110 | 114 | } |
| 111 | 115 | |