WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 1 of Ticket #65839


Ignore:
Timestamp:
08/09/2026 11:30:08 AM (2 months ago)
Author:
hamishwright
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #65839 – Description

    initial v1  
    1 WordPress Site Health reports a false positive of the REST API as failing with:
     1WordPress Site Health can falsely report the REST API as failing with:
    22
    3 ```text
    4 REST API Endpoint: https://example.com/wp-json/wp/v2/types/post?context=edit
    5 REST API Response: (403) Forbidden
    6 ```
     3 REST API Endpoint: https://example.com/wp-json/wp/v2/types/post?context=edit
     4 REST API Response: (403) Forbidden
    75
    86The REST response body is:
    97
    10 ```json
     8{{{#!json
    119{"code":"rest_cookie_invalid_nonce","message":"Cookie check failed","data":{"status":403}}
    12 ```
     10}}}
    1311
    1412In `WP_Site_Health::get_test_rest_availability()`, core builds the loopback request using:
    1513
    16 ```php
     14{{{#!php
     15<?php
    1716$cookies = wp_unslash( $_COOKIE );
    18 ...
    1917$r = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );
    20 ```
     18}}}
    2119
    2220This sends the entire browser cookie jar to the REST endpoint, not just WordPress authentication cookies.
    … …  
    2422On the affected site, a diagnostic confirmed:
    2523
    26 ```text
    27 WordPress auth cookies only      -> 200
    28 WP_Http_Cookie objects only      -> 200
    29 Explicit Cookie header only      -> 200
    30 Full $_COOKIE jar, as Site Health -> 403 rest_cookie_invalid_nonce
    31 ```
     24 WordPress auth cookies only      -> 200
     25 WP_Http_Cookie objects only      -> 200
     26 Explicit Cookie header only      -> 200
     27 Full $_COOKIE jar, as Site Health -> 403 rest_cookie_invalid_nonce
    3228
    3329The full cookie jar included unrelated cookies from analytics, LiteSpeed, Cloudflare, WooCommerce, Sourcebuster, Jetpack, `wp-settings-*`, and others. When the outgoing Site Health REST loopback request was filtered to include only:
    3430
    35 ```text
    36 wordpress_logged_in_*
    37 wordpress_sec_*
    38 wordpress_test_cookie
    39 ```
     31 wordpress_logged_in_*
     32 wordpress_sec_*
     33 wordpress_test_cookie
    4034
    4135the Site Health REST API warning cleared immediately.
    4236
    43 Expected behavior:
     37**Expected behavior:**
    4438
    4539Site Health’s authenticated REST loopback test should only send the WordPress cookies required for authentication, or otherwise avoid allowing unrelated browser cookies to interfere with REST nonce/cookie validation.
    4640
    47 Actual behavior:
     41**Actual behavior:**
    4842
    49 Site Health passes all of `$_COOKIE` into the loopback request. A sufficiently large or complex browser cookie jar can cause the REST API availability test to return a false 403, even though the REST endpoint and WordPress authentication cookies are working correctly.
     43Site Health passes all of `$_COOKIE` into the loopback request.A sufficiently large or otherwise problematic browser cookie jar can cause the REST API availability test to return a false 403, even though the REST endpoint and WordPress authentication cookies are working correctly.
    5044
    51 Suggested fix:
     45**Suggested fix:**
    5246
    5347In `WP_Site_Health::get_test_rest_availability()`, filter `$cookies` before passing them to `wp_remote_get()` so only WordPress authentication/test cookies are sent.