Ticket #41696: 41696.diff

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -240 +240 @@
                  */
                 $this->send_header( 'X-Content-Type-Options', 'nosniff' );
                 $this->send_header( 'Access-Control-Expose-Headers', 'X-WP-Total, X-WP-TotalPages' );
-                $this->send_header( 'Access-Control-Allow-Headers', 'Authorization, Content-Type' );
+
+                $allowed_headers = [
+                        'Authorization',
+                        'Content-Disposition',
+                        'Content-MD5',
+                        'Content-Type',
+                ];
+
+                /**
+                 * Filter allowed headers for Cross-Origin requests.
+                 *
+                 * The allowed headers are passed to the browser to specify which
+                 * headers can be passed to the REST API. By default, we allow the
+                 * Content-* headers needed to upload files to the media endpoints.
+                 *
+                 * @since 4.9.0
+                 *
+                 * @param array $allowed_headers List of allowed headers to be passed in Access-Control-Allow-Headers
+                 */
+                $allowed_headers = apply_filters( 'rest_allowed_cors_headers', $allowed_headers );
+
+                $this->send_header( 'Access-Control-Allow-Headers', implode( ', ', $allowed_headers ) );
 
                 /**
                  * Send nocache headers on authenticated requests.