Context Navigation

← Previous Ticket
Next Ticket →

#8281 closed defect (bug) (fixed)

Navigation menu and search button broken on codex.wordpress.org

Reported by:	joedolson	Owned by:
Priority:	normal	Milestone:
Component:	Codex	Keywords:	has-patch
Cc:

Description

Scripts loaded from wordpress.org, e.g. the interactivity API, are throwing a CORS error due to missing headers in the codex. This breaks the menu and search trigger.

Change History (3)

This ticket was mentioned in PR #742 on WordPress/wporg-mu-plugins by @dd32.

7 weeks ago #1

Keywords has-patch added; needs-patch removed

Scripts loaded from wordpress.org, such as the Interactivity API script module, throw CORS errors when embedded in the Codex because wordpress.org does not send the required CORS headers. This breaks the header menu and search trigger.

## Fix

In rest_render_codex_global_header(), rewrite wp-content asset URLs in the rendered markup to load from the s.w.org CDN, which does send the necessary CORS headers:

$markup = str_replace( content_url(), 'https://s.w.org/wp-content', $markup );

## Notes

Verified against the live endpoint (/wp-json/global-header-footer/v1/header/codex): the only wp-content asset is the Interactivity API script module, which appears in both the <script type="importmap"> JSON and the <link rel="modulepreload"> href. A markup-level str_replace catches both, whereas a script_loader_src filter would miss script modules.
Because content_url() is https://wordpress.org/wp-content, only asset URLs are rewritten; navigation links (wordpress.org/plugins/, /themes/, etc.) are untouched.
Only the host is swapped, so the per-file content-hash ?ver= cache buster is preserved and remains unique, ensuring the CDN serves fresh content when a file changes.

Fixes https://meta.trac.wordpress.org/ticket/8281

🤖 Generated with Claude Code

#2 @dd32
7 weeks ago

Resolution → fixed
Status new → closed

https://github.com/WordPress/wporg-mu-plugins/pull/742

Codex is cached and updates it's templates periodically.

Last edited 7 weeks ago by dd32 (previous) (diff)

This ticket was mentioned in PR #743 on WordPress/wporg-mu-plugins by @dd32.

6 weeks ago #3

Follow-up to #742, which fixed the header. The Codex (and Trac) also embed the global footer markup cross-origin, and its scripts still load from wordpress.org/wp-content, which does not send CORS headers. That throws CORS errors in the Codex footer.

Verified against the live /wp-json/global-header-footer/v1/footer endpoint, the cross-origin wp-content scripts are:

plugins/gutenberg/build/modules/block-library/navigation/view.js
mu-plugins/pub-sync/blocks/time/build/view.js
mu-plugins/pub-sync/blocks/global-header-footer/js/view.js

## Fix

Extract the header CDN rewrite from #742 into a shared rewrite_assets_to_cdn() helper and apply it to the footer endpoint as well:

function rewrite_assets_to_cdn( $markup ) {
    return str_replace( content_url(), 'https://s.w.org/wp-content', $markup );
}

## Notes

The Codex grabs the shared /footer endpoint (there is no codex-specific footer route), so the rewrite lives in rest_render_global_footer(). This also benefits Trac and Planet, which embed the same footer cross-origin and have the identical CORS exposure.
The REST endpoint is only used by external consumers; the on-site footer is rendered directly via render_global_footer() and is unaffected.
Because content_url() is https://wordpress.org/wp-content, only asset URLs are rewritten; navigation links are untouched.
Only the host is swapped, so each per-file content-hash ?ver= cache buster is preserved and remains unique.

Fixes https://meta.trac.wordpress.org/ticket/8281

🤖 Generated with Claude Code

Note: See TracTickets for help on using tickets.

Download in other formats:

Making WordPress.org