Changeset 48452 for trunk/src/wp-includes/rest-api/class-wp-rest-server.php

Timestamp:

07/12/2020 07:35:55 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Add Content-Disposition, Content-MD5 and X-WP-Nonce as allowed cors headers.

The Content-Disposition and Content-MD5 headers allow for easier file uploading across domains by using a File/Blob object directly. The X-WP-Nonce header is allowed for making cross-origin and same-origin authenticated requests consistent.

Additionally a filter is introduced, "rest_allowed_cors_headers", to simplify the process of allowing additional request headers.

Props rmccue, TimothyBlynJacobs.
Fixes #41696.

File:

• trunk/src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -256 +256 @@
 
         $this->send_header( 'Access-Control-Expose-Headers', implode( ', ', $expose_headers ) );
-        $this->send_header( 'Access-Control-Allow-Headers', 'Authorization, Content-Type' );
+
+        $allow_headers = array(
+            'Authorization',
+            'X-WP-Nonce',
+            'Content-Disposition',
+            'Content-MD5',
+            'Content-Type',
+        );
+
+        /**
+         * Filters the list of request headers that are allowed for CORS requests.
+         *
+         * The allowed headers are passed to the browser to specify which
+         * headers can be passed to the REST API. By default, we allow the
+         * Content-* headers needed to upload files to the media endpoints.
+         * As well as the Authorization and Nonce headers for allowing authentication.
+         *
+         * @since 5.5.0
+         *
+         * @param string[] $allow_headers The list of headers to allow.
+         */
+        $allow_headers = apply_filters( 'rest_allowed_cors_headers', $allow_headers );
+
+        $this->send_header( 'Access-Control-Allow-Headers', implode( ', ', $allow_headers ) );
 
         /**