Support

December 1, 2020 at 3:17 pm

Hi Steve,

The app uses the WP REST API to communicate with the site and does so using the Basic Auth plugin.

So it doesn’t ‘login’ to a specific URL first but rather sends an authorization header on each request set to the site which is used for authentication.

The very first request sent from the app is to check if the site can load over HTTPS. So it sends a HTTP request to the domain and checks for a redirect. It then sends a HTTPS request to the domain and checks for response 200. Aftr that the request sent to /wp-json/ee/v4.8.36/site_info would be the first one where authentication is used.

That help?

December 9, 2020 at 5:47 am

Hi Steve,

I installed Clean Talk on a test site and didn’t have any issue logging into the app until I enabled Anti-Crawler setting.

What options do you have enabled on Clean Talk?

I’d like to test logging into the app and capture the request to see what is actually happening on those request, can you send me temp login details so I can take a look?

You can use this form to send the credentials: https://eventespresso.com/send-login-details/

Obviously, you’ll also need to enable Clean-Talk if you currently have it disabled.

December 9, 2020 at 3:22 pm

Hi Steve,

So I logged into the site and the problem is not from Clean Talk plugin, it’s the Advanced noCaptcha & invisible Captcha plugin you have installed.

I’ve seen this before, only not on the REST requests and what’s happening is that plugin is hooking into ALL login requests and trying to validate a recaptcha response, which you simply can not do on within a REST request.

A simple fix would be to disable the Advanced Recaptcha on the login forms, that should allow both plugins to be enabled but will obviously disable the reCaptcha on your standard login forms. Another option is to look into hooking into the reCaptcha plugin and see if it has a hook available to bail out of the request if its REST.

Side note – in your form submission you mentioned we already have a login and I just want to clarify that we don’t keep login details for any longer than necessary so we actually don’t have a login. The credentials sent over will have been deleted as soon as whatever issue you previously submitted the details for was closed/resolved. If there is still an admin account active on the site for us I recommend removing it when finished, the login details are intended to be temporary as we do not want nor need constant access to anyone’s site.