Ticket #35662: 35662.3.diff

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -250 +250 @@
                         }
                 }
 
+                $nonce = null;
+
+                // Find existing nonce.
+                if ( isset( $_REQUEST['_wpnonce'] ) ) {
+                        $nonce = $_REQUEST['_wpnonce'];
+                } elseif ( isset( $_SERVER['HTTP_X_WP_NONCE'] ) ) {
+                        $nonce = $_SERVER['HTTP_X_WP_NONCE'];
+                }
+
+                // Check the nonce.
+                $nonce_is_valid = wp_verify_nonce( $nonce, 'wp_rest' );
+                $user_and_nonce = is_user_logged_in() && $nonce_is_valid;
+
                 /**
+                 * Filter whether the REST API should send a refreshed nonce header in responses to
+                 * authenticated requests that include a valid nonce.
+                 *
+                 * @since 4.5.0
+                 *
+                 * @param bool $rest_send_refreshed_nonce Whether to send a refreshed nonce in the response headers.
+                 *                                        Defaults to true if the user is logged in and the the
+                 *                                        existing request nonce is valid.
+                 */
+                $rest_send_refreshed_nonce = apply_filters( 'rest_send_refreshed_nonce', $user_and_nonce );
+                if ( $rest_send_refreshed_nonce ) {
+                        $this->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
+                }
+
+                /**
                  * Filter whether the REST API is enabled.
                  *
                  * @since 4.4.0