[wp-trac] [WordPress Trac] #62232: WordPress Application Password CORS error when Headless WordPress URL and Site URL are different

[WordPress Trac]

#62232: WordPress Application Password CORS error when Headless WordPress URL and
Site URL are different
-----------------------------------------------+---------------------------
 Reporter:  archoda                            |       Owner:  (none)
     Type:  defect (bug)                       |      Status:  new
 Priority:  normal                             |   Milestone:  Awaiting
                                               |  Review
Component:  REST API                           |     Version:  6.6.2
 Severity:  critical                           |  Resolution:
 Keywords:  has-screenshots reporter-feedback  |     Focuses:  ui, rest-api
-----------------------------------------------+---------------------------
Changes (by dd32):

 * keywords:  has-screenshots => has-screenshots reporter-feedback


Comment:

 Hi @archoda and welcome to trac.

 This sounds correct-ish.

 `wp-json` is a front-end rest-api route, which in your case is hosted on
 `http://mysite.local`.

 WordPress should send the correct access-control-allow-origin header for
 both the front-end and admin-url.

 I believe the issue at hand here may be that CORS is not able to be used
 on the hostname you're using, I know that Chrome doesn't allow localhost,
 but I'm not sure what it does with `.local` hostnames.

 The screenshot provided showing `Invalid Value` to me suggests that it's
 rejecting the header provided.

 Can you supply the Request & Response headers instead?

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62232#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform