Repository navigation

REST API: Add the rest_allowed_cors_methods filter and stop discarding a response's method list. - #13151

Open

moonmeister wants to merge 43 commits into

WordPress:trunkfrom

moonmeister:fix/rest-cors-allow-methods-clobber

Open

REST API: Add the rest_allowed_cors_methods filter and stop discarding a response's method list.#13151
moonmeister wants to merge 43 commits into
WordPress:trunkfrom
moonmeister:fix/rest-cors-allow-methods-clobber

Commits on Aug 17, 2026
- fix: tests and conditional set of defaults
  moonmeister
  committed
  3f08a51
Commits on Aug 18, 2026
- REST API: Add the `rest_allowed_cors_methods` filter.
  moonmeister
  committed
  694fccd
- REST API: Trim the ordering comment in `rest_send_cors_headers()`.
  
  moonmeister
  and
  claude
  committed
  8bb0c27
- Merge branch 'trunk' into fix/rest-cors-allow-methods-clobber
  moonmeister
  authored
  d8de848
Commits on Sep 15, 2026
Commits on Sep 30, 2026
- Merge branch 'trunk' into fix/rest-cors-allow-methods-clobber
  adamsilverstein
  authored
  85c3d9b
Commits on Oct 17, 2026
- Merge branch 'trunk' into fix/rest-cors-allow-methods-clobber
  adamsilverstein
  authored
  c1f3194
Commits on Oct 19, 2026
- Merge branch 'trunk' into fix/rest-cors-allow-methods-clobber
  adamsilverstein
  authored
  696734b
- Add missing ext-xdebug to suggest in composer.json
  westonruter
  committed
  d2c2f0e
- Fix PHPStan errors in tests
  westonruter
  committed
  86857b2
- Add native type hints for params
  westonruter
  committed
  326b89e
- Apply batched suggestions from code review
  
  adamsilverstein
  and
  westonruter
  authored
  f961c3e
- Fix syntax error from prior suggestion
  westonruter
  authored
  f1de1db
- REST API: Fix the parse error in rest_send_cors_headers().
  adamsilverstein
  committed
  f862087
- Tests: Drop the Xdebug dependency from the REST CORS header tests.
  adamsilverstein
  committed
  9a017d9
- REST API: Harden the arguments to rest_send_cors_headers().
  adamsilverstein
  committed
  62058a0
- REST API: Remove the CORS methods header when the filtered list is empty.
  
  adamsilverstein
  and
  claude
  committed
  674e883
- REST API: Validate CORS methods from the response by syntax, not the default list.
  
  moonmeister
  and
  claude
  committed
  3756a7f
- Merge branch 'trunk' into fix/rest-cors-allow-methods-clobber
  moonmeister
  authored
  a8fc56d
Commits on Oct 20, 2026
- REST API: Send CORS headers through WP_REST_Server instead of raw header() calls.
  
  moonmeister
  and
  claude
  committed
  55010b8
- Merge branch 'fix/rest-cors-allow-methods-clobber' of github.com:moonmeister/wordpress-develop into fix/rest-cors-allow-methods-clobber
  moonmeister
  committed
  ca6d58d
- Fix PHPStan errors
  westonruter
  committed
  fab020a
- Fix PHPStan errors in tests
  westonruter
  committed
  f5c14f6
- Add a since tag
  westonruter
  committed
  e8ecdd9
- REST API: Keep the WP_REST_Server::send_header() signature unchanged.
  
  westonruter
  and
  claude
  committed
  96b7592
- REST API: Drop the native parameter types from rest_send_cors_headers().
  
  westonruter
  and
  claude
  committed
  2614921
- REST API: Avoid setting up the REST server from rest_send_cors_headers().
  
  westonruter
  and
  claude
  committed
  2a02e41
- REST API: Validate the filtered CORS method list.
  
  westonruter
  and
  claude
  committed
  a557b2e
- REST API: Fall back to the default CORS methods for an unusable response value.
  
  westonruter
  and
  claude
  committed
  9c01533
- Docs: Note the `$server` parameter of rest_send_cors_headers() in its since tag.
  
  westonruter
  and
  claude
  committed
  9359781
- Add phpdoc to address PHPStan error for closure return value
  westonruter
  committed
  fc72d81
- REST API: Reject CORS methods with a trailing newline.
  
  westonruter
  and
  claude
  committed
  382df14
- REST API: Drop CORS method entries that are not strings.
  
  westonruter
  and
  claude
  committed
  24664ea
- REST API: Split filtered CORS method entries like a string value.
  
  westonruter
  and
  claude
  committed
  c40d5dd
- REST API: Remove the CORS methods header for an empty list without a server.
  
  westonruter
  and
  claude
  committed
  68bfacd
- Tests: Describe how the REST CORS header tests observe headers.
  
  westonruter
  and
  claude
  committed
  06f2f2c
- Tests: Use the default CORS methods constant in the assertions.
  
  westonruter
  and
  claude
  committed
  a33ad8f
- Tests: Restore the request method after the REST CORS header tests.
  
  westonruter
  and
  claude
  committed
  2715e83
- REST API: Ignore a filtered CORS method value that is not a list.
  
  westonruter
  and
  claude
  committed
  852f1f0
- REST API: Send each CORS method only once.
  
  westonruter
  and
  claude
  committed
  08385b0
- Tests: Restore the Origin after the REST CORS header tests.
  
  westonruter
  and
  claude
  committed
  8b844f8

Commits

Commits on Aug 17, 2026

Commits on Aug 18, 2026

Commits on Sep 15, 2026

Commits on Sep 30, 2026

Commits on Oct 17, 2026

Commits on Oct 19, 2026

Commits on Oct 20, 2026