WordPress Rest API doesn’t appear to handle custom URL schemes

Hi, I think that happens because rest_send_cors_headers() calls sanitize_url() on the origin, which calls esc_url(). That function changes the value to '' because custom is not an allowed protocol.

You can use the kses_allowed_protocols filter to add it to the list of allowed protocols.

Here’s the relevant source code:

https://github.com/WordPress/WordPress/blob/caddf7e3dc3f94579e40b833c62f648371b691bf/wp-includes/rest-api.php#L741

https://github.com/WordPress/WordPress/blob/caddf7e3dc3f94579e40b833c62f648371b691bf/wp-includes/formatting.php#L4554-L4560

https://github.com/WordPress/WordPress/blob/caddf7e3dc3f94579e40b833c62f648371b691bf/wp-includes/functions.php#L6991

Thanks Ian, I added my required protocols to the filter and it works perfectly now.

Glad to hear it ??

Hello @mralimac
Could you please explain a bit more how did you do that.
Did you go with adding code to your wp project? Could you share please more details?
I am obliged to use a wordpress backend and I am new at this thechno. I am having the same problem since I am using now capacitor for the frontend.

Thanks

@rbs27 Certainly. I thought I had submitted my code here. Guess I forgot!

I added the following to my Theme’s functions.php file.

add_filter( 'kses_allowed_protocols', function ( $protocols ) {
    $protocols[] = 'nuxtmobile';
	$protocols[] = 'custom';
	$protocols[] = 'capacitor';
    return $protocols;
} );

You should only need to really add one to match whatever your schema is in Capacitor. But I added a few to cover multiple tests I was doing. I hope this helps!