Ticket #36451: 36451.4.diff

src/wp-includes/rest-api.php

@@ -331 +331 @@
         }
 
         if ( is_ssl() ) {
-                // If the current host is the same as the REST URL host, force the REST URL scheme to HTTPS.
-                if ( $_SERVER['SERVER_NAME'] === parse_url( get_home_url( $blog_id ), PHP_URL_HOST ) ) {
+                // If the current host is the same as the REST URL host, force the REST
+                // URL scheme to HTTPS.
+                $home_url_hostname = parse_url( get_home_url( $blog_id ), PHP_URL_HOST );
+                if ( $_SERVER['SERVER_NAME'] === $home_url_hostname ) {
                         $url = set_url_scheme( $url, 'https' );
                 }
         }
 
+        if ( is_admin() && force_ssl_admin() ) {
+                // In this situation the home URL may be http:, and `is_ssl()` may be
+                // false, but the admin is served over https: (one way or another), so
+                // REST API usage will be blocked by browsers unless it is also served
+                // over SSL.
+                $url = set_url_scheme( $url, 'https' );
+        }
+
         /**
          * Filters the REST URL.
          *