Don't send headers early in Store API (https://github.com/woocommerce/woocommerce-blocks/pull/10241)
This commit is contained in:
parent
42db1bb4ab
commit
23cb8fe320
|
@ -61,14 +61,15 @@ class Authentication {
|
||||||
}
|
}
|
||||||
|
|
||||||
// Send standard CORS headers.
|
// Send standard CORS headers.
|
||||||
header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
|
$server = rest_get_server();
|
||||||
header( 'Access-Control-Allow-Credentials: true' );
|
$server->send_header( 'Access-Control-Allow-Methods', 'OPTIONS, GET, POST, PUT, PATCH, DELETE' );
|
||||||
header( 'Vary: Origin', false );
|
$server->send_header( 'Access-Control-Allow-Credentials', 'true' );
|
||||||
|
$server->send_header( 'Vary', 'Origin', false );
|
||||||
|
|
||||||
// Allow preflight requests, certain http origins, and any origin if a cart token is present. Preflight requests
|
// Allow preflight requests, certain http origins, and any origin if a cart token is present. Preflight requests
|
||||||
// are allowed because we'll be unable to validate cart token headers at that point.
|
// are allowed because we'll be unable to validate cart token headers at that point.
|
||||||
if ( $this->is_preflight() || $this->has_valid_cart_token( $request ) || is_allowed_http_origin( $origin ) ) {
|
if ( $this->is_preflight() || $this->has_valid_cart_token( $request ) || is_allowed_http_origin( $origin ) ) {
|
||||||
header( 'Access-Control-Allow-Origin: ' . $origin );
|
$server->send_header( 'Access-Control-Allow-Origin', $origin );
|
||||||
}
|
}
|
||||||
|
|
||||||
// Exit early during preflight requests. This is so someone cannot access API data by sending an OPTIONS request
|
// Exit early during preflight requests. This is so someone cannot access API data by sending an OPTIONS request
|
||||||
|
|
Loading…
Reference in New Issue