Ticket #35662: 35662.2.diff

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -251 +251 @@
                 }
 
                 /**
+                 * Filter whether to send a refreshed nonce header in response authenticated
+                 * requests that include a valid nonce.
+                 *
+                 * @since 4.5.0
+                 *
+                 * @param bool $rest_send_refreshed_nonce Whether to send a refreshed nonce in the response headers.
+                 */
+                $nonce = null;
+
+                // Find existing nonce.
+                if ( isset( $_REQUEST['_wpnonce'] ) ) {
+                        $nonce = $_REQUEST['_wpnonce'];
+                } elseif ( isset( $_SERVER['HTTP_X_WP_NONCE'] ) ) {
+                        $nonce = $_SERVER['HTTP_X_WP_NONCE'];
+                }
+
+                // Check the nonce.
+                $nonce_is_valid = wp_verify_nonce( $nonce, 'wp_rest' );
+
+                $rest_send_refreshed_nonce = apply_filters( 'rest_send_refreshed_nonce', is_user_logged_in() && $nonce_is_valid );
+                $this->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
+
+                /**
                  * Filter whether the REST API is enabled.
                  *
                  * @since 4.4.0