1

I had a wordpress wp-admin running on a different domain.

In other words WP_SITEURL = 'https//admin.example.com' and WP_HOME = 'https://www.example.com'

Recently I had the bad idea to updated wordpress to the latest version.

All seems work fine but after I realized that was impossibile add a new post or updated an existing one.

For example when I added a new post (/wp-admin/post-new.php) there were few fetch requests from admin to www:

https://www.example.com/wp-json/wp/v2/users/me?_locale=user
https://www.example.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user

Both of them had the same error:

Access to fetch at
'https://www.example.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user'
from origin 'https://admin.example.com' has been blocked by CORS
policy: Request header field x-wp-nonce is not allowed by
Access-Control-Allow-Headers in preflight response.

Looking around I found out that would be easy add a new CORS directive, so promptly added this:

add_filter('rest_pre_serve_request', function( $value ) {
    header( 'Access-Control-Allow-Headers: X-WP-Nonce', false);
    return $value;
});

Ironically the result was even worst, now I have an infinite requests that fail with 403

https://www.example.com/wp-json/wp/v2/users/me?_locale=user
https://www.example.com/wp-json/wp/v2/users/me?_locale=user
https://www.example.com/wp-json/wp/v2/users/me?_locale=user
...

Now I'm stuck trying to understand what's wrong, and if there is any way to solve this issue.

Any help to understand what's happening is appreciated.

3
  • I'm having the same problem here. The only difference is that the user is not allowed to access wp-admin directly through the domain application (security issues), only from one of the IP nodes from the cluster. So i'm facing a CORS problem because my IP_NODE is trying to access DOMAIN.com wp-json api. Did you find a solution ?
    – Max
    Nov 24, 2021 at 18:25
  • by the way. The 403 problem is because wp-nonce is a unique number used once for the transaction (like a cookie or something) and is pratically impossible to use it like a JWT behaviour or something (I the way that with jwt it is possible to inform that i'm a authenticated user and have permission to make this request)
    – Max
    Nov 24, 2021 at 18:29
  • Well after many many tries I gave up
    – freedev
    Nov 24, 2021 at 18:34

1 Answer 1

0

You could try to go through the SQL DB and find the references to admin.example and change them to example.com

Another way to do this is use a plugin like Search & Replace

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.