Ticket #48309: 48309.diff

src/wp-includes/rest-api.php

@@ -588 +588 @@
                 header( 'Access-Control-Allow-Origin: ' . $origin );
                 header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
                 header( 'Access-Control-Allow-Credentials: true' );
-                header( 'Vary: Origin' );
+                header( 'Vary: Origin', false );
         } elseif ( ! headers_sent() && 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
-                header( 'Vary: Origin' );
+                header( 'Vary: Origin', false );
         }
 
         return $value;