CANTINA-913: Match protocol in CORS header

001-core.php

@@ -164,3 +164,16 @@ function vip_prevent_invalid_core_query_args() {
 }
 
 add_action( 'wp_loaded', 'vip_prevent_invalid_core_query_args', 1 );
+
+add_filter( 'allowed_http_origins', 'vip_only_https_origins' );
+
+/**
+ * Only allow HTTPS origins on VIP
+ *
+ * @param array $origins
+ */
+function vip_only_https_origins( $origins ) {
+	return array_filter( $origins, function ( $origin ) {
+		return strpos( $origin, 'https://' ) === 0;
+	} );
+}

tests/test-core-filters.php

@@ -0,0 +1,17 @@
+<?php
+
+class Core_Filters_Test extends WP_UnitTestCase {
+	public function test_vip_only_https_origins(): void {
+		$input = [
+			0 => 'http://example.com',
+			1 => 'https://example.com',
+		];
+
+		$expected = [
+			1 => 'https://example.com',
+		];
+
+		$actual = vip_only_https_origins( $input );
+		self::assertSame( $expected, $actual );
+	}
+}