I had a wordpress wp-admin running on a different domain.
In other words WP_SITEURL = 'https//admin.example.com' and WP_HOME = 'https://www.example.com'
Recently I had the bad idea to updated wordpress to the latest version.
All seems work fine but after I realized that was impossibile add a new post or updated an existing one.
For example when I added a new post (/wp-admin/post-new.php) there were few fetch requests from admin to www:
https://www.example.com/wp-json/wp/v2/users/me?_locale=user
https://www.example.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user
Both of them had the same error:
Access to fetch at
'https://www.example.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user'
from origin 'https://admin.example.com' has been blocked by CORS
policy: Request header field x-wp-nonce is not allowed by
Access-Control-Allow-Headers in preflight response.
Looking around I found out that would be easy add a new CORS directive, so promptly added this:
add_filter('rest_pre_serve_request', function( $value ) {
header( 'Access-Control-Allow-Headers: X-WP-Nonce', false);
return $value;
});
Ironically the result was even worst, now I have an infinite requests that fail with 403
https://www.example.com/wp-json/wp/v2/users/me?_locale=user
https://www.example.com/wp-json/wp/v2/users/me?_locale=user
https://www.example.com/wp-json/wp/v2/users/me?_locale=user
...
Now I'm stuck trying to understand what's wrong, and if there is any way to solve this issue.
Any help to understand what's happening is appreciated.
