W3cubDocs

/WordPress

WP_REST_Server::serve_request( string $path = null )

Handles serving an API request.

Description

Matches the current server URI to a route and runs the first matching callback then outputs a JSON representation of the returned value.

Parameters

$path

(string) (Optional) The request route. If not set, $_SERVER['PATH_INFO'] will be used.

Default value: null

Return

(null|false) Null if not served and a HEAD request, false otherwise.

Source

File: wp-includes/rest-api/class-wp-rest-server.php

public function serve_request( $path = null ) {
		$content_type = isset( $_GET['_jsonp'] ) ? 'application/javascript' : 'application/json';
		$this->send_header( 'Content-Type', $content_type . '; charset=' . get_option( 'blog_charset' ) );
		$this->send_header( 'X-Robots-Tag', 'noindex' );

		$api_root = get_rest_url();
		if ( ! empty( $api_root ) ) {
			$this->send_header( 'Link', '<' . esc_url_raw( $api_root ) . '>; rel="https://api.w.org/"' );
		}

		/*
		 * Mitigate possible JSONP Flash attacks.
		 *
		 * https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
		 */
		$this->send_header( 'X-Content-Type-Options', 'nosniff' );
		$expose_headers = array( 'X-WP-Total', 'X-WP-TotalPages', 'Link' );

		/**
		 * Filters the list of response headers that are exposed to CORS requests.
		 *
		 * @since 5.5.0
		 *
		 * @param string[] $expose_headers The list of headers to expose.
		 */
		$expose_headers = apply_filters( 'rest_exposed_cors_headers', $expose_headers );

		$this->send_header( 'Access-Control-Expose-Headers', implode( ', ', $expose_headers ) );

		$allow_headers = array(
			'Authorization',
			'X-WP-Nonce',
			'Content-Disposition',
			'Content-MD5',
			'Content-Type',
		);

		/**
		 * Filters the list of request headers that are allowed for CORS requests.
		 *
		 * The allowed headers are passed to the browser to specify which
		 * headers can be passed to the REST API. By default, we allow the
		 * Content-* headers needed to upload files to the media endpoints.
		 * As well as the Authorization and Nonce headers for allowing authentication.
		 *
		 * @since 5.5.0
		 *
		 * @param string[] $allow_headers The list of headers to allow.
		 */
		$allow_headers = apply_filters( 'rest_allowed_cors_headers', $allow_headers );

		$this->send_header( 'Access-Control-Allow-Headers', implode( ', ', $allow_headers ) );

		/**
		 * Send nocache headers on authenticated requests.
		 *
		 * @since 4.4.0
		 *
		 * @param bool $rest_send_nocache_headers Whether to send no-cache headers.
		 */
		$send_no_cache_headers = apply_filters( 'rest_send_nocache_headers', is_user_logged_in() );
		if ( $send_no_cache_headers ) {
			foreach ( wp_get_nocache_headers() as $header => $header_value ) {
				if ( empty( $header_value ) ) {
					$this->remove_header( $header );
				} else {
					$this->send_header( $header, $header_value );
				}
			}
		}

		/**
		 * Filters whether the REST API is enabled.
		 *
		 * @since 4.4.0
		 * @deprecated 4.7.0 Use the {@see 'rest_authentication_errors'} filter to
		 *                   restrict access to the API.
		 *
		 * @param bool $rest_enabled Whether the REST API is enabled. Default true.
		 */
		apply_filters_deprecated(
			'rest_enabled',
			array( true ),
			'4.7.0',
			'rest_authentication_errors',
			sprintf(
				/* translators: %s: rest_authentication_errors */
				__( 'The REST API can no longer be completely disabled, the %s filter can be used to restrict access to the API, instead.' ),
				'rest_authentication_errors'
			)
		);

		/**
		 * Filters whether jsonp is enabled.
		 *
		 * @since 4.4.0
		 *
		 * @param bool $jsonp_enabled Whether jsonp is enabled. Default true.
		 */
		$jsonp_enabled = apply_filters( 'rest_jsonp_enabled', true );

		$jsonp_callback = null;

		if ( isset( $_GET['_jsonp'] ) ) {
			if ( ! $jsonp_enabled ) {
				echo $this->json_error( 'rest_callback_disabled', __( 'JSONP support is disabled on this site.' ), 400 );
				return false;
			}

			$jsonp_callback = $_GET['_jsonp'];
			if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {
				echo $this->json_error( 'rest_callback_invalid', __( 'Invalid JSONP callback function.' ), 400 );
				return false;
			}
		}

		if ( empty( $path ) ) {
			if ( isset( $_SERVER['PATH_INFO'] ) ) {
				$path = $_SERVER['PATH_INFO'];
			} else {
				$path = '/';
			}
		}

		$request = new WP_REST_Request( $_SERVER['REQUEST_METHOD'], $path );

		$request->set_query_params( wp_unslash( $_GET ) );
		$request->set_body_params( wp_unslash( $_POST ) );
		$request->set_file_params( $_FILES );
		$request->set_headers( $this->get_headers( wp_unslash( $_SERVER ) ) );
		$request->set_body( self::get_raw_data() );

		/*
		 * HTTP method override for clients that can't use PUT/PATCH/DELETE. First, we check
		 * $_GET['_method']. If that is not set, we check for the HTTP_X_HTTP_METHOD_OVERRIDE
		 * header.
		 */
		if ( isset( $_GET['_method'] ) ) {
			$request->set_method( $_GET['_method'] );
		} elseif ( isset( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] ) ) {
			$request->set_method( $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'] );
		}

		$result = $this->check_authentication();

		if ( ! is_wp_error( $result ) ) {
			$result = $this->dispatch( $request );
		}

		// Normalize to either WP_Error or WP_REST_Response...
		$result = rest_ensure_response( $result );

		// ...then convert WP_Error across.
		if ( is_wp_error( $result ) ) {
			$result = $this->error_to_response( $result );
		}

		/**
		 * Filters the API response.
		 *
		 * Allows modification of the response before returning.
		 *
		 * @since 4.4.0
		 * @since 4.5.0 Applied to embedded responses.
		 *
		 * @param WP_HTTP_Response $result  Result to send to the client. Usually a WP_REST_Response.
		 * @param WP_REST_Server   $this    Server instance.
		 * @param WP_REST_Request  $request Request used to generate the response.
		 */
		$result = apply_filters( 'rest_post_dispatch', rest_ensure_response( $result ), $this, $request );

		// Wrap the response in an envelope if asked for.
		if ( isset( $_GET['_envelope'] ) ) {
			$result = $this->envelope_response( $result, isset( $_GET['_embed'] ) );
		}

		// Send extra data from response objects.
		$headers = $result->get_headers();
		$this->send_headers( $headers );

		$code = $result->get_status();
		$this->set_status( $code );

		/**
		 * Filters whether the request has already been served.
		 *
		 * Allow sending the request manually - by returning true, the API result
		 * will not be sent to the client.
		 *
		 * @since 4.4.0
		 *
		 * @param bool             $served  Whether the request has already been served.
		 *                                           Default false.
		 * @param WP_HTTP_Response $result  Result to send to the client. Usually a WP_REST_Response.
		 * @param WP_REST_Request  $request Request used to generate the response.
		 * @param WP_REST_Server   $this    Server instance.
		 */
		$served = apply_filters( 'rest_pre_serve_request', false, $result, $request, $this );

		if ( ! $served ) {
			if ( 'HEAD' === $request->get_method() ) {
				return null;
			}

			// Embed links inside the request.
			$embed  = isset( $_GET['_embed'] ) ? rest_parse_embed_param( $_GET['_embed'] ) : false;
			$result = $this->response_to_data( $result, $embed );

			/**
			 * Filters the API response.
			 *
			 * Allows modification of the response data after inserting
			 * embedded data (if any) and before echoing the response data.
			 *
			 * @since 4.8.1
			 *
			 * @param array            $result  Response data to send to the client.
			 * @param WP_REST_Server   $this    Server instance.
			 * @param WP_REST_Request  $request Request used to generate the response.
			 */
			$result = apply_filters( 'rest_pre_echo_response', $result, $this, $request );

			// The 204 response shouldn't have a body.
			if ( 204 === $code || null === $result ) {
				return null;
			}

			$result = wp_json_encode( $result );

			$json_error_message = $this->get_json_last_error();

			if ( $json_error_message ) {
				$json_error_obj = new WP_Error(
					'rest_encode_error',
					$json_error_message,
					array( 'status' => 500 )
				);

				$result = $this->error_to_response( $json_error_obj );
				$result = wp_json_encode( $result->data[0] );
			}

			if ( $jsonp_callback ) {
				// Prepend '/**/' to mitigate possible JSONP Flash attacks.
				// https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
				echo '/**/' . $jsonp_callback . '(' . $result . ')';
			} else {
				echo $result;
			}
		}

		return null;
	}

Uses

Uses	Description
wp-includes/rest-api/class-wp-rest-server.php: rest_exposed_cors_headers	Filters the list of response headers that are exposed to CORS requests.
wp-includes/rest-api/class-wp-rest-server.php: rest_allowed_cors_headers	Filters the list of request headers that are allowed for CORS requests.
wp-includes/rest-api.php: rest_parse_embed_param()	Parses the “_embed” parameter into the list of resources to embed.
wp-includes/rest-api/class-wp-rest-server.php: rest_pre_echo_response	Filters the API response.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::remove_header()	Removes an HTTP header from the current response.
wp-includes/functions.php: wp_check_jsonp_callback()	Checks that a JSONP callback is a valid JavaScript callback name.
wp-includes/plugin.php: apply_filters_deprecated()	Fires functions attached to a deprecated filter hook.
wp-includes/rest-api.php: get_rest_url()	Retrieves the URL to a REST endpoint on a site.
wp-includes/rest-api.php: rest_ensure_response()	Ensures a REST response is a response object (for consistency).
wp-includes/rest-api/class-wp-rest-request.php: WP_REST_Request::__construct()	Constructor.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::get_headers()	Extracts headers from a PHP-style $_SERVER array.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::send_header()	Sends an HTTP header.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::get_raw_data()	Retrieves the raw request entity (body).
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::send_headers()	Sends multiple HTTP headers.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::set_status()	Sends an HTTP status code.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::dispatch()	Matches the request to a callback and call it.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::get_json_last_error()	Returns if an error occurred during most recent JSON encode/decode.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::envelope_response()	Wraps the response in an envelope.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::response_to_data()	Converts a response to data to send.
wp-includes/rest-api/class-wp-rest-server.php: rest_send_nocache_headers	Send nocache headers on authenticated requests.
wp-includes/rest-api/class-wp-rest-server.php: rest_enabled	Filters whether the REST API is enabled.
wp-includes/rest-api/class-wp-rest-server.php: rest_jsonp_enabled	Filters whether jsonp is enabled.
wp-includes/rest-api/class-wp-rest-server.php: rest_post_dispatch	Filters the API response.
wp-includes/rest-api/class-wp-rest-server.php: rest_pre_serve_request	Filters whether the request has already been served.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::json_error()	Retrieves an appropriate error representation in JSON.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::check_authentication()	Checks the authentication headers if supplied.
wp-includes/rest-api/class-wp-rest-server.php: WP_REST_Server::error_to_response()	Converts an error to a response object.
wp-includes/functions.php: wp_json_encode()	Encode a variable into JSON, with some sanity checks.
wp-includes/l10n.php: __()	Retrieve the translation of $text.
wp-includes/formatting.php: wp_unslash()	Remove slashes from a string or array of strings.
wp-includes/formatting.php: esc_url_raw()	Performs esc_url() for database usage.
wp-includes/pluggable.php: is_user_logged_in()	Determines whether the current visitor is a logged in user.
wp-includes/functions.php: wp_get_nocache_headers()	Get the header information to prevent caching.
wp-includes/plugin.php: apply_filters()	Calls the callback functions that have been added to a filter hook.
wp-includes/option.php: get_option()	Retrieves an option value based on an option name.
wp-includes/load.php: is_wp_error()	Check whether variable is a WordPress Error.
wp-includes/class-wp-error.php: WP_Error::__construct()	Initialize the error.

Changelog

Version	Description
4.4.0	Introduced.

© 2003–2019 WordPress Foundation
Licensed under the GNU GPLv2+ License.
https://developer.wordpress.org/reference/classes/wp_rest_server/serve_request