REST API – CSRF

Hi Vijay,

Really my question now is in two parts – if I use

remove_filter( 'rest_pre_serve_request', 'rest_send_cors_headers' );
	add_filter( 'rest_pre_serve_request', function( $value ) {

Then it looks lik ethat applies to all WP REST API end points. Is that right – as I only want it to apply to my custom end point.

This article https://legacy.joshpress.net/access-control-headers-for-the-wordpress-rest-api/

says

That said, keep in mind that the class WP_REST_Response, which should be used for all responses, also gives you the ability to add headers. Any headers unique to a request should be set there.

But now i’m thinking that setting headers is not the right approach anyway and I should uses nonces from the from end to back end to restrict access to the end point – what do you think?