From 91a724474aa7742a7f307cf6bdf1240b45cf2a8b Mon Sep 17 00:00:00 2001
From: Khokan Sardar <itzmekhokan@gmail.com>
Date: Mon, 10 Aug 2026 09:38:52 +0530
Subject: [PATCH] Site Health: Send only WordPress cookies with the REST API
 test.

The REST API availability test forwarded the visitor's entire browser
cookie jar to the loopback request. Only WordPress' own cookies have any
bearing on that request, and unrelated cookies have been reported to fail
it with a 403 rest_cookie_invalid_nonce on sites where the same request
succeeds when limited to the WordPress cookies.

Restrict the forwarded cookies to the cookie names WordPress defines.
Sites whose edge or host requires another cookie to reach the endpoint
can restore it through the existing http_request_args filter.

Fixes #65839.
---
 .../includes/class-wp-site-health.php         | 12 ++++-
 tests/phpunit/tests/admin/wpSiteHealth.php    | 47 +++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php
index 2ddfaadc4b39d..8c6cf8d5cd57d 100644
--- a/src/wp-admin/includes/class-wp-site-health.php
+++ b/src/wp-admin/includes/class-wp-site-health.php
@@ -2187,6 +2187,7 @@ public function get_test_http_requests() {
 	 * This is required for the new block editor to work, so we explicitly test for this.
 	 *
 	 * @since 5.2.0
+	 * @since 7.1.0 Only WordPress' own cookies are sent with the request.
 	 *
 	 * @return array The test results.
 	 */
@@ -2206,7 +2207,16 @@ public function get_test_rest_availability() {
 			'test'        => 'rest_availability',
 		);
 
-		$cookies = wp_unslash( $_COOKIE );
+		/*
+		 * Only WordPress' own cookies have any bearing on this request. Forwarding the rest of
+		 * the browser's cookie jar lets unrelated cookies fail a test that is meant to measure
+		 * the REST API.
+		 */
+		$cookies = array_intersect_key(
+			wp_unslash( $_COOKIE ),
+			array_flip( array( AUTH_COOKIE, SECURE_AUTH_COOKIE, LOGGED_IN_COOKIE, TEST_COOKIE ) )
+		);
+
 		$timeout = 10; // 10 seconds.
 		$headers = array(
 			'Cache-Control' => 'no-cache',
diff --git a/tests/phpunit/tests/admin/wpSiteHealth.php b/tests/phpunit/tests/admin/wpSiteHealth.php
index 6080b477f54c3..43bb453861376 100644
--- a/tests/phpunit/tests/admin/wpSiteHealth.php
+++ b/tests/phpunit/tests/admin/wpSiteHealth.php
@@ -707,4 +707,51 @@ public function test_get_test_opcode_cache_result_by_environment() {
 			$this->assertStringContainsString( __( 'Enabling this cache can significantly improve the performance of your site.' ), $result['description'] );
 		}
 	}
+
+	/**
+	 * Tests that only WordPress' own cookies are sent with the REST API test request.
+	 *
+	 * @ticket 65839
+	 *
+	 * @covers ::get_test_rest_availability()
+	 */
+	public function test_get_test_rest_availability_sends_only_wordpress_cookies() {
+		$original_cookie = $_COOKIE;
+
+		$_COOKIE = array(
+			LOGGED_IN_COOKIE     => 'admin|1700000000|token|hmac',
+			TEST_COOKIE          => 'WP Cookie check',
+			'_ga'                => 'GA1.1.123456789.1700000000',
+			'wp-settings-time-1' => '1700000000',
+		);
+
+		$sent = null;
+
+		add_filter(
+			'pre_http_request',
+			static function ( $response, $parsed_args ) use ( &$sent ) {
+				$sent = $parsed_args['cookies'];
+
+				return array(
+					'response' => array( 'code' => 200 ),
+					'body'     => '',
+				);
+			},
+			10,
+			2
+		);
+
+		$this->instance->get_test_rest_availability();
+
+		$_COOKIE = $original_cookie;
+
+		$this->assertSame(
+			array(
+				LOGGED_IN_COOKIE => 'admin|1700000000|token|hmac',
+				TEST_COOKIE      => 'WP Cookie check',
+			),
+			$sent,
+			'Only WordPress\' own cookies should be sent with the REST API test request.'
+		);
+	}
 }