class Spokes::Middleware::CORS
Provides CORS
HTTP access control.
Usage:
class Application < Rails::Application config.middleware.use Spokes::Middleware::CORS end
Example response:
$ curl -v -L http://localhost:3000/ -H "Origin: http://elsewhere" -X OPTIONS > OPTIONS / HTTP/1.1 > User-Agent: curl/7.37.1 > Host: localhost:3000 > Accept: */* > Origin: http://elsewhere > < HTTP/1.1 200 OK < Access-Control-Allow-Origin: http://elsewhere < Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS < Access-Control-Allow-Headers: *, Content-Type, Accept, AUTHORIZATION, Cache-Control < Access-Control-Allow-Credentials: true < Access-Control-Max-Age: 1728000 < Access-Control-Expose-Headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma < Cache-Control: no-cache < X-Request-Id: 1d388184-5dd6-4150-bf47-1729f33794ec < X-Runtime: 0.001269 < Transfer-Encoding: chunked
Constants
- ALLOW_HEADERS
- ALLOW_METHODS
- EXPOSE_HEADERS
Public Class Methods
new(app)
click to toggle source
# File lib/spokes/middleware/cors.rb, line 40 def initialize(app) @app = app end
Public Instance Methods
call(env)
click to toggle source
# File lib/spokes/middleware/cors.rb, line 44 def call(env) # preflight request: render a stub 200 with the CORS headers if cors_request?(env) && env['REQUEST_METHOD'] == 'OPTIONS' [200, cors_headers(env), ['']] else status, headers, response = @app.call(env) headers.merge!(cors_headers(env)) if cors_request?(env) [status, headers, response] end end
cors_headers(env)
click to toggle source
# File lib/spokes/middleware/cors.rb, line 59 def cors_headers(env) { 'Access-Control-Allow-Origin' => env['HTTP_ORIGIN'], 'Access-Control-Allow-Methods' => ALLOW_METHODS.join(', '), 'Access-Control-Allow-Headers' => ALLOW_HEADERS.join(', '), 'Access-Control-Allow-Credentials' => 'true', 'Access-Control-Max-Age' => '1728000', 'Access-Control-Expose-Headers' => EXPOSE_HEADERS.join(', ') } end
cors_request?(env)
click to toggle source
# File lib/spokes/middleware/cors.rb, line 55 def cors_request?(env) env.key?('HTTP_ORIGIN') end