Add a proper permission callback to the endpoint that get the JWT

Author: kmgalanakis

includes/rest-routes.php

@@ -26,12 +26,63 @@ function add_endpoints() {
 		[
 			'methods'             => 'GET',
 			'callback'            => __NAMESPACE__ . '\get_jwt',
-			'permission_callback' => '__return_true',
+			'permission_callback' => __NAMESPACE__ . '\check_jwt_permission',
 		]
 	);
 }
 
+/**
+ * Check if the current user has permission to access the JWT endpoint.
+ *
+ * This endpoint requires authentication to prevent unauthorized access
+ * to sensitive JWT tokens containing Apple Maps credentials.
+ *
+ * SECURITY NOTE: While same-origin checking is implemented as a fallback
+ * for public frontend maps, requiring authentication is the most secure approach.
+ * Consider implementing nonce-based authentication for public pages if needed.
+ *
+ * @return bool|WP_Error True if user has permission, WP_Error otherwise.
+ */
+function check_jwt_permission() {
+	// Primary security: Require authentication.
+	if ( is_user_logged_in() ) {
+		return true;
+	}
+
+	// Fallback for public frontend maps: Verify same-origin request
+	// Note: This is less secure than authentication but allows public maps to function.
+	$site_url  = get_fqdn_from_url( get_site_url() );
+	$site_host = wp_parse_url( $site_url, PHP_URL_HOST );
+
+	// Check Referer header (more reliable for same-origin requests).
+	if ( isset( $_SERVER['HTTP_REFERER'] ) ) {
+		$referer      = esc_url_raw( wp_unslash( $_SERVER['HTTP_REFERER'] ) );
+		$referer_host = wp_parse_url( $referer, PHP_URL_HOST );
 
+		// Allow if referer host matches site host.
+		if ( $referer_host === $site_host ) {
+			return true;
+		}
+	}
+
+	// Check Origin header (for CORS requests, but should be blocked for security).
+	if ( isset( $_SERVER['HTTP_ORIGIN'] ) ) {
+		$origin      = esc_url_raw( wp_unslash( $_SERVER['HTTP_ORIGIN'] ) );
+		$origin_host = wp_parse_url( $origin, PHP_URL_HOST );
+
+		// Only allow if origin matches site host.
+		if ( $origin_host === $site_host ) {
+			return true;
+		}
+	}
+
+	// Block all unauthenticated requests without valid same-origin verification.
+	return new WP_Error(
+		'rest_forbidden',
+		__( 'You must be logged in to access this endpoint.', 'maps-block-apple' ),
+		[ 'status' => rest_authorization_required_code() ]
+	);
+}
 
 /**
  * Encode String.