Installing Duo Universal blocks Woocommerce /wp-json/wc/v3/ endpoint

[zforsman]

After installing the Duo Universal plugin, a major feature of a website no longer works because product data cannot be returned

Description

ajax requests to product endpoints return '<', "<!DOCTYPE "... is not valid JSON errors
this endpoint is being redirected to the login screen '/wp-json/wc/v3/products?category=' + id + '&consumer_key=' + consumer_key + '&consumer_secret=' + consumer_secret + '&orderby=title&order=asc',

Expected Behavior

Should return a list a products with a given category id

Actual Behavior

Returns the HTML of the login page instead of JSON product data

Steps to Reproduce

Visit a url like this https://example.com/wp-json/wc/v3/products?category=39&consumer_key=consumer_key_value&consumer_secret=consumer_secret_value and get redirected to the wordpress login page

Workarounds

Currently no workaround.

This seems like a major issue.

[zforsman]

Turns out this was just due to Duo not being setup correctly.

[zforsman]

This actually wasn't a misconfiguration issue, I only thought it was fixed because I was able to get around the issue while I was logged in. So Duo is blocking Woocommerce endpoints for non-logged in users.

[jeffreyparker]

Thanks for reporting this! Digging into this, the issue is that WooCommerce REST API keys are directly tied to specific user accounts, and if that user account is configured to require Duo 2FA, then that API Key will also require 2FA, which is why it redirects to the login page (and therefore shows the login page HTML when the REST endpoint is access via ajax).

The Duo plugin has a setting to toggle on/off 2FA requirements for individual roles. One potential workaround may to be disable 2FA for a specific role, create a single user with that role, and generate the REST API key linked to that user account. One challenge might be finding a role which has the capabilities WooCommerce requires, without being too permissive and reducing your overall security. This section of the documentation https://woocommerce.com/document/roles-capabilities/#section-3 mentions a few plugins capable of adding/modifying roles. It may be possible to create a new role specifically for this purpose, and give it the exact capabilities required.