class Onsi::CORSHeaders

Generates CORS Headers using a request env.

@example Creating headers in a before_action

def assign_cors_headers
  Onsi::CORSHeaders.generate(request.env) do |header, value|
    response.headers[header] = value
  end
end

Constants

CORS_ALLOWED_HEADER

@private

Default Allowed Headers

CORS_ALLOWED_METHOD

@private

Default Allowed Methods

CORS_EXPOSE_HEADER

@private

Default Expose Headers

CORS_KNOWN_ORIGIN

@private

Default Known Origins

CORS_VARY

@private

Default Vary

CUSTOMIZED_VALUES

@private

Values that can be customized

Attributes

request[R]

@private

The request object.

@return [Rack::Request]

Public Class Methods

generate(env) click to toggle source

Create the CORS headers.

@param env [Hash] The request env to generate CORS headers from.

@return [Hash]

# File lib/onsi/cors_headers.rb, line 83
def generate(env)
  new(env).generate
end
new(env) click to toggle source

@private

@param env [Hash] The request env for CORS Headers

# File lib/onsi/cors_headers.rb, line 120
def initialize(env)
  @request = Rack::Request.new(env)
end

Public Instance Methods

generate() click to toggle source

@private

Generates CORS headers

# File lib/onsi/cors_headers.rb, line 128
def generate
  {}.tap do |headers|
    headers['Access-Control-Allow-Credentials'] = 'true'
    headers['Access-Control-Allow-Origin']      = allowed_origin if allowed_origin
    headers['Access-Control-Expose-Headers']    = self.class.expose_headers.to_a.join(', ')
    headers['Access-Control-Allow-Methods']     = self.class.allowed_methods.to_a.join(', ')
    headers['Access-Control-Allow-Headers']     = self.class.allowed_headers.to_a.join(', ')
    headers['Vary']                             = self.class.varys.to_a.join(', ')
  end
end

Private Instance Methods

acceptable_options_request?() click to toggle source
# File lib/onsi/cors_headers.rb, line 163
def acceptable_options_request?
  options_request? && request_from_known_origin?
end
allowed_origin() click to toggle source
# File lib/onsi/cors_headers.rb, line 155
def allowed_origin
  if acceptable_options_request?
    origin_value if request_from_known_origin?
  else
    '*'
  end
end
options_request?() click to toggle source
# File lib/onsi/cors_headers.rb, line 171
def options_request?
  request.request_method == 'OPTIONS'
end
origin() click to toggle source
# File lib/onsi/cors_headers.rb, line 145
def origin
  @origin ||= Addressable::URI.parse(origin_header)
rescue Addressable::URI::InvalidURIError
  Addressable::URI.new
end
origin_header() click to toggle source
# File lib/onsi/cors_headers.rb, line 141
def origin_header
  (request.env['HTTP_ORIGIN'].presence || request.env['Origin'].presence).to_s
end
origin_value() click to toggle source
# File lib/onsi/cors_headers.rb, line 151
def origin_value
  origin.to_s
end
request_from_known_origin?() click to toggle source
# File lib/onsi/cors_headers.rb, line 167
def request_from_known_origin?
  self.class.known_origins.include?(origin.host)
end