Ticket #38060: 38060.patch

src/wp-includes/rest-api.php

@@ -408 +408 @@
                 header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
                 header( 'Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE' );
                 header( 'Access-Control-Allow-Credentials: true' );
+                header( 'Vary: Origin' );
         }
 
         return $value;