Changeset 38806

Timestamp:

10/17/2016 04:10:37 PM (8 years ago)

Author:

jorbin

Message:

REST API: Include Vary: Origin in cors headers

vary: origin is a W3 CORS implementation recommendation( ​https://www.w3.org/TR/cors/#resource-implementation ). It's used by default in frameworks such as hapi and Laravel-cors. Overall, it helps sites siting behind a cache such as varnish.

Fixes #38060.
Props procodewp, pdufour for research.

File:

• trunk/src/wp-includes/rest-api.php (modified) (1 diff)

trunk/src/wp-includes/rest-api.php

@@ -409 +409 @@
         header( 'Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE' );
         header( 'Access-Control-Allow-Credentials: true' );
+        header( 'Vary: Origin' );
     }