From 969e4255a9abd3221dce6b4fe309fa0876bc37cc Mon Sep 17 00:00:00 2001 From: Aaron Jorbin Date: Mon, 17 Oct 2016 16:11:30 +0000 Subject: [PATCH] REST API: Include `Vary: Origin` in cors headers `vary: origin` is a W3 CORS implementation recommendation( https://www.w3.org/TR/cors/#resource-implementation ). It's used by default in frameworks such as hapi and Laravel-cors. Overall, it helps sites siting behind a cache such as varnish. Fixes #38060. Props procodewp, pdufour for research. Built from https://develop.svn.wordpress.org/trunk@38806 git-svn-id: http://core.svn.wordpress.org/trunk@38749 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/rest-api.php | 1 + wp-includes/version.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/wp-includes/rest-api.php b/wp-includes/rest-api.php index 620ca925b9..6da931e77a 100644 --- a/wp-includes/rest-api.php +++ b/wp-includes/rest-api.php @@ -408,6 +408,7 @@ function rest_send_cors_headers( $value ) { header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) ); header( 'Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE' ); header( 'Access-Control-Allow-Credentials: true' ); + header( 'Vary: Origin' ); } return $value; diff --git a/wp-includes/version.php b/wp-includes/version.php index a7eeff968f..1c07ea222b 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.7-alpha-38805'; +$wp_version = '4.7-alpha-38806'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.