id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc	focuses
65839	Site Health REST API test can fail with rest_cookie_invalid_nonce when full browser cookie jar is sent	hamishwright		"WordPress Site Health can falsely report the REST API as failing with:

 REST API Endpoint: https://example.com/wp-json/wp/v2/types/post?context=edit
 REST API Response: (403) Forbidden

The REST response body is:

{{{#!json
{""code"":""rest_cookie_invalid_nonce"",""message"":""Cookie check failed"",""data"":{""status"":403}}
}}}

In `WP_Site_Health::get_test_rest_availability()`, core builds the loopback request using:

{{{#!php
<?php
$cookies = wp_unslash( $_COOKIE );
$r = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );
}}}

This sends the entire browser cookie jar to the REST endpoint, not just WordPress authentication cookies.

On the affected site, a diagnostic confirmed:

 WordPress auth cookies only      -> 200
 WP_Http_Cookie objects only      -> 200
 Explicit Cookie header only      -> 200
 Full $_COOKIE jar, as Site Health -> 403 rest_cookie_invalid_nonce

The full cookie jar included unrelated cookies from analytics, LiteSpeed, Cloudflare, WooCommerce, Sourcebuster, Jetpack, `wp-settings-*`, and others. When the outgoing Site Health REST loopback request was filtered to include only:

 wordpress_logged_in_*
 wordpress_sec_*
 wordpress_test_cookie

the Site Health REST API warning cleared immediately.

**Expected behavior:**

Site Health’s authenticated REST loopback test should only send the WordPress cookies required for authentication, or otherwise avoid allowing unrelated browser cookies to interfere with REST nonce/cookie validation.

**Actual behavior:**

Site Health passes all of `$_COOKIE` into the loopback request.A sufficiently large or otherwise problematic browser cookie jar can cause the REST API availability test to return a false 403, even though the REST endpoint and WordPress authentication cookies are working correctly.

**Suggested fix:**

In `WP_Site_Health::get_test_rest_availability()`, filter `$cookies` before passing them to `wp_remote_get()` so only WordPress authentication/test cookies are sent."	defect (bug)	new	normal		Site Health	7.0.3	minor		rest-api false-positive site-health has-patch has-unit-tests		tests, rest-api