Make WordPress Core

#46992 closed enhancement (invalid)

Add a filter which allows the HTTP headers for REST API Endpoints to be changed

Reported by: sudar Owned by: adamsilverstein
Milestone: Priority: normal
Severity: normal Version: 5.2
Component: REST API Keywords: has-patch
Focuses: Cc:


Right now there is no way to modify the HTTP response headers for a REST API Endpoint.

The HTTP headers for non REST API endpoint requests can be changed using the wp_headers filter, but it won't work for REST Endpoints.

I am proposing to add a new filter called wp_rest_headers that allows developers to override the HTTP Response headers of REST API Endpoints.

Attachments (1)

46992.diff (756 bytes) - added by sudar 14 months ago.

Download all attachments as: .zip

Change History (10)

14 months ago

#1 @SergeyBiryukov
14 months ago

  • Milestone changed from Awaiting Review to 5.3

#2 @TimothyBlynJacobs
14 months ago

What's the use case for this filter that can't be solved using the rest_post_dispatch filter?

#3 @adamsilverstein
14 months ago

@TimothyBlynJacobs the goal here is to modify the CORS headers in responses from WP REST API Endpoints. It doesn't look like this is possible using the rest_post_dispatch filter you mentioned, am I missing something?

#4 @adamsilverstein
14 months ago

  • Owner set to adamsilverstein
  • Status changed from new to assigned

#5 @TimothyBlynJacobs
14 months ago

But doesn't rest_send_cors_headers() use a regular header function call, it doesn't go through WP_REST_Server?

#6 @sudar
14 months ago


The rest_send_cors_headers function uses the regular header php function to send the headers, but the headers that are sent are hardcoded in that function. There is no easy way to change the headers that will be passed to the header function.

We have to remove the rest_send_cors_headers from the rest_pre_serve_request filter and then manually perform what is already done by rest_send_cors_headers function and then print the required headers.

On the other hand if you want to change the headers for non rest pages, then all you have to do is hook into the wp_headers function and return the desired headers as array.

This patch introduces a new filter, so that we can easily change the headers for rest api endpoints similar to how we do it for non rest api endpoints.

Please let me know if my explanation is clear or if you still have any other questions.

#7 @TimothyBlynJacobs
14 months ago

But how will this filter help in that case?

The headers sent by rest_send_cors_headers won't be filterable that proposed filter.

#8 @aaemnnosttv
11 months ago

@TimothyBlynJacobs is correct - it is currently possible to add/remove/change headers sent by a REST request using the https://developer.wordpress.org/reference/hooks/rest_post_dispatch/ filter.

add_filter( 'rest_post_dispatch', function ( \WP_REST_Response $response ) {
    $headers                   = $response->get_headers();
    $headers['X-Added-Header'] = 'Foo';

    $response->set_headers( $headers );

    return $response;
} );

This filter provides the Response, Server, and Request object instances to the callback which should provide all the context necessary to modify the response as needed.

#9 @adamsilverstein
11 months ago

  • Milestone 5.3 deleted
  • Resolution set to invalid
  • Status changed from assigned to closed

Thanks for the feedback @TimothyBlynJacobs and @aaemnnosttv - I'm closing this as invalid.

Please feel free to re-open @sudar if you feel there is still an outstanding use case not addressed by the approach described above using the rest_post_dispatch filter.

Note: See TracTickets for help on using tickets.