[wp-trac] [WordPress Trac] #62903: permission_callback should be called before validate_callback in REST API

[WordPress Trac]

#62903: permission_callback should be called before validate_callback in REST API
--------------------------+------------------------------
 Reporter:  donjajo       |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  REST API      |     Version:  trunk
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:  rest-api
--------------------------+------------------------------

Comment (by dd32):

 I believe what you're seeing is correct.

 `validate_callback` shouldn't be used to validate whether it's correct for
 a user, rather, it should validate that the value presented is correct for
 the field.

 For example:
 {{{
 validate_callback: Validate that the ID input is numeric. This should only
 fail for always invalid inputs.

 permission_callback: Verify that the user is logged in, and has access to
 the referenced item

 callback: Fetch data, output
 }}}

 It would be best practice to also include capability checks in the
 callback itself, rather than purely relying upon the permission_callback,
 as capability checks should be relatively cheap computation wise.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62903#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform