WC_Form_Handler::set_reset_password_bridge_headers │ public static │ WC 11.2.0

Prevent storage and referrer disclosure of password-reset bridge handles.

Method of the class: WC_Form_Handler{}

No Hooks.

Returns

array<string, string>. Filtered response headers.

Usage

$result = WC_Form_Handler::set_reset_password_bridge_headers( $headers );

$headers(array<string, string>) (required)

Response headers.

Changelog

WC_Form_Handler::set_reset_password_bridge_headers() WC Form Handler::set reset password bridge headers code ^{WC 11.2.2}

public static function set_reset_password_bridge_headers( $headers ) {
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( empty( $_GET['reset-token'] ) || empty( $_GET['show-reset-form'] ) ) {
		return $headers;
	}

	$bridge_handle = wc_clean( wp_unslash( $_GET['reset-token'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( ! WC_Shortcode_My_Account::is_password_reset_bridge_handle( $bridge_handle ) || ! is_account_page() ) {
		return $headers;
	}

	WC_Cache_Helper::set_nocache_constants();
	$headers = array_merge( $headers, wp_get_nocache_headers() );

	/*
	 * WC_Cache_Helper::prevent_caching() drops no-store for logged-out visitors to preserve
	 * bfcache, and wp_get_nocache_headers() is filterable. Spell the directives out so a page
	 * carrying a reset credential is never stored, whatever those two decided.
	 */
	$headers['Cache-Control']   = 'no-cache, no-store, must-revalidate, max-age=0, private';
	$headers['Referrer-Policy'] = 'no-referrer';

	return $headers;
}