basic-auth.php

<?php
/**
 * Plugin Name: JSON Basic Authentication
 * Description: Basic Authentication handler for the JSON API, used for development and debugging purposes
 * Author: WordPress API Team
 * Author URI: https://github.com/WP-API
 * Version: 0.1
 * Plugin URI: https://github.com/WP-API/Basic-Auth
 */
function json_basic_auth_handler($user) {
    global $wp_json_basic_auth_error;

    $wp_json_basic_auth_error = null;

    /**
     * Don't authenticate twice if X-WP-FORCE-REAUTH header is not set or if it is false
     * This allow you to re-authenticate user which might be required when working with node-wpapi
     * (such as in case of allowing user to change his password using REST API)
     */
    $forceReauth = (isset($_SERVER['HTTP_X_WP_FORCE_REAUTH']) && $_SERVER['HTTP_X_WP_FORCE_REAUTH']);
    if (!empty($user) && !$forceReauth) {
        return $user;
    }

    // Check that we're trying to authenticate
    if (!isset($_SERVER['PHP_AUTH_USER'])) {
        return $user;
    }

    $username = $_SERVER['PHP_AUTH_USER'];
    $password = $_SERVER['PHP_AUTH_PW'];

    /**
     * In multi-site, wp_authenticate_spam_check filter is run on authentication. This filter calls
     * get_currentuserinfo which in turn calls the determine_current_user filter. This leads to infinite
     * recursion and a stack overflow unless the current function is removed from the determine_current_user
     * filter during authentication.
     */
    remove_filter('determine_current_user', 'json_basic_auth_handler', 10);

    $user = wp_authenticate($username, $password);

    add_filter('determine_current_user', 'json_basic_auth_handler', 10);

    if (is_wp_error($user)) {
        $wp_json_basic_auth_error = $user;
        return null;
    }

    $wp_json_basic_auth_error = true;

    return $user->ID;
}

add_filter('determine_current_user', 'json_basic_auth_handler', 10);

function json_basic_auth_error($error) {
    // Passthrough other errors
    if (!empty($error)) {
        return $error;
    }

    global $wp_json_basic_auth_error;

    return $wp_json_basic_auth_error;
}

add_filter('rest_authentication_errors', 'json_basic_auth_error');