Skip to content

feat: AJAX uses token authentication#181

Draft
dcalhoun wants to merge 10 commits intotrunkfrom
feat/authorize-ajax-with-application-passwords
Draft

feat: AJAX uses token authentication#181
dcalhoun wants to merge 10 commits intotrunkfrom
feat/authorize-ajax-with-application-passwords

Conversation

@dcalhoun
Copy link
Member

@dcalhoun dcalhoun commented Sep 19, 2025

Related:

What?

Authenticate AJAX requests with application passwords send via an authorization
header.

Why?

The GutenbergKit editor does not have authorization cookies, so we must rely
upon a different authorization mechanism.

Ref CMM-713. Close CMM-768.

How?

Set the Authorization header via jQuery.ajaxSetup and by overloading the
window.wp.ajax utilities.

Testing Instructions

  1. Apply the required Jetpack changes and WPCOM (192611-ghe-Automattic/wpcom) changes to your site.
  2. Proxy your test device's networking through to your modified WPCOM in step 1.
  3. Open the experimental block editor in the Jetpack mobile app.
  4. Insert a VideoPress block.
  5. Attach media.
  6. Verify the upload succeeds.

Accessibility Testing Instructions

N/A, no navigation changes.

Screenshots or screencast

N/A, no visual changes.

@dcalhoun dcalhoun added the [Type] Enhancement A suggestion for improvement. label Sep 19, 2025
@dcalhoun dcalhoun force-pushed the feat/authorize-ajax-with-application-passwords branch from a051ea4 to 682e0df Compare September 19, 2025 20:00
@dcalhoun dcalhoun changed the title feat: Authorize AJAX with application passwords feat: Authorize AJAX with token authentication Sep 24, 2025
@dcalhoun dcalhoun changed the title feat: Authorize AJAX with token authentication feat: AJAX uses token authentication Sep 25, 2025
@dcalhoun dcalhoun force-pushed the feat/authorize-ajax-with-application-passwords branch from 686ebf7 to bbaf9c4 Compare January 13, 2026 19:35
@dcalhoun
Copy link
Member Author

@claude

@claude

This comment was marked as outdated.

dcalhoun and others added 10 commits February 12, 2026 12:22
Include authorization header in AJAX requets, as we do not have cookies
to send in the mobile app environment.
If we configure AJAX before loading the library, the configuration is
overridden.
This global is often used by WordPress Admin page scripts.
Useful when needing to allow CORS for specific domains.
Address PR feedback about potential race condition. The code now checks
if `window.wp.ajax.send` and `window.wp.ajax.post` are functions before
wrapping them. This prevents TypeError when calling the wrapped function
if the original method was undefined during configuration.

Update tests to verify that missing methods remain undefined rather than
being wrapped with an undefined reference.

Co-authored-by: Claude <noreply@anthropic.com>
@dcalhoun dcalhoun force-pushed the feat/authorize-ajax-with-application-passwords branch from 394bce2 to ea73b3c Compare February 12, 2026 17:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

[Type] Enhancement A suggestion for improvement.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant