CANTINA-913: Match protocol in CORS header

Only allow HTTPS origins on VIP
Automattic · Oct 23, 2023 · 13090b5 · 13090b5
1 parent 746f135
commit 13090b5
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/001-core.php b/001-core.php
@@ -164,3 +164,16 @@ function vip_prevent_invalid_core_query_args() {
 }
 
 add_action( 'wp_loaded', 'vip_prevent_invalid_core_query_args', 1 );
+
+add_filter( 'allowed_http_origins', 'vip_only_https_origins', PHP_INT_MAX );
+
+/**
+ * Only allow HTTPS origins on VIP
+ * 
+ * @param array $origins
+ */
+function vip_only_https_origins( $origins ) {
+    return array_filter( $origins, function( $origin ) {
+        return strpos( $origin, 'https://' ) === 0;
+    });
+}