From b224c251adfa16a5f84074a3c0886270c9df38de Mon Sep 17 00:00:00 2001
From: whyisjake <whyisjake@git.wordpress.org>
Date: Mon, 14 Oct 2019 15:43:04 +0000
Subject: [PATCH] REST API: Send a Vary: Origin header on GET requests.

Add this header on all GET requests to prevent cached requests.

Props darthhexx, davidbinda, nickdaugherty, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46478


git-svn-id: http://core.svn.wordpress.org/trunk@46276 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/rest-api.php | 2 ++
 wp-includes/version.php  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/wp-includes/rest-api.php b/wp-includes/rest-api.php
index 3e6f419f6b..b998cf7cda 100644
--- a/wp-includes/rest-api.php
+++ b/wp-includes/rest-api.php
@@ -589,6 +589,8 @@ function rest_send_cors_headers( $value ) {
 		header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
 		header( 'Access-Control-Allow-Credentials: true' );
 		header( 'Vary: Origin' );
+	} else if ( 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
+		header( 'Vary: Origin' );
 	}
 
 	return $value;
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 76be1c0883..838d9192f9 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-beta3-46477';
+$wp_version = '5.3-beta3-46478';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.