CORS for the WordPress REST API

cors-for-the-wordpress-rest-api.php

<?php

function my_customize_rest_cors() {
	remove_filter( 'rest_pre_serve_request', 'rest_send_cors_headers' );
	add_filter( 'rest_pre_serve_request', function( $value ) {
		header( 'Access-Control-Allow-Origin: *' );
		header( 'Access-Control-Allow-Methods: GET' );
		header( 'Access-Control-Allow-Credentials: true' );
		header( 'Access-Control-Expose-Headers: Link', false );

		return $value;
	} );
}

add_action( 'rest_api_init', 'my_customize_rest_cors', 15 );

how to use this file, where should i add it ?

This header is also necessary.

header( 'Access-Control-Allow-Headers: X-Requested-With' );

function my_customize_rest_cors() {
remove_filter( 'rest_pre_serve_request', 'rest_send_cors_headers' );
add_filter( 'rest_pre_serve_request', function( $value ) {
header( 'Access-Control-Allow-Origin: *' );
header( 'Access-Control-Allow-Methods: GET' );
header( 'Access-Control-Allow-Credentials: true' );
header( 'Access-Control-Expose-Headers: Link', false );
return $value;
} );
}
add_action( 'rest_api_init', 'my_customize_rest_cors', 15 );

Where i have to put this code

where should I put this code?

where should I put this code?

In functions.php

For me this does not work, it just adds one more origin

I posted a question with more details to Stack Overflow

Hi, the code worked for me. I put the code in a custom plugin for a specific WordPress project. Thanks.

Thanks !! Works perfectly well with Wordpress latest !

If you want to get more control here are some resources worth seeing:

• Some guy blog with several good examples
• MDN Web Docs aboyt Server-Side Access Control (CORS)
• WP API issue on the same matter
• Original Wordpress function that checks CORS

Thanks, It worked 👍

Thanks, after 2 crazy day you save me

does it has something to do with WooCommerce ? it seems not

@mtrabelsi What is your point there? This is to add the missing CORS headers to WP-json, in short, yes it can be linked to WooCommerce, depending on your use.

You are a lifesaver! Thank you!

Hi, I have a problem with several Access-Control-Allow headers additionally to already existing one (highlighted in orange in attached Screenshot). Could this my_customize_rest_cors function help to solve my problem?