wppaste
WordPress

apply_filters( 'rest_allowed_cors_headers', string[] $allow_headers, WP_REST_Request $request )

Since
5.5.0, 6.3.0
Filters the list of request headers that are allowed for REST API CORS requests.

Description

The allowed headers are passed to the browser to specify which headers can be passed to the REST API. By default, we allow the Content-* headers needed to upload files to the media endpoints.
As well as the Authorization and Nonce headers for allowing authentication.

Compatibility

WordPress
since 6.3.0
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in every tracked release (6.7.7 to 7.1.0).

Parameters

$allow_headersstring[]
The list of request headers to allow.
$requestWP_REST_Request
The request in context.

Where this hook fires · 1

  • wp-includes/rest-api/class-wp-rest-server.php:434WP_REST_Server::serve_request()

Source code

View on Trac View on GitHub 

		 * @since 5.5.0		 * @since 6.3.0 The `$request` parameter was added.		 *		 * @param string[]        $allow_headers The list of request headers to allow.		 * @param WP_REST_Request $request       The request in context.		 */		$allow_headers = apply_filters( 'rest_allowed_cors_headers', $allow_headers, $request ); 		$this->send_header( 'Access-Control-Allow-Headers', implode( ', ', $allow_headers ) ); 		$result = $this->check_authentication(); 		if ( ! is_wp_error( $result ) ) {

Changelog

Introduced in 5.5.0. Unchanged from 6.7.7 through 7.1.0.

  1. 6.7.7
  2. 6.8.8
  3. 6.9.7
  4. 7.0.4
  5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

6.3.0
The $request parameter was added.from the docblock
5.5.0
Introduced.from the docblock

About this page

Parsed data
Generated from the wordpress-develop 7.1.0 tag, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.