module Sinatra::Cors::Helpers
Public Instance Methods
allowed_methods()
click to toggle source
# File lib/sinatra/cors.rb, line 72 def allowed_methods matches = [] settings.routes.each do |method, routes| routes.each do |route| process_route(route[0], route[1]) do |application, pattern| matches << method end end end matches.uniq end
cors()
click to toggle source
# File lib/sinatra/cors.rb, line 6 def cors if is_cors_request? unless origin_is_allowed? logger.warn bad_origin_message return end if is_preflight_request? unless method_is_allowed? logger.warn bad_method_message return end unless headers_are_allowed? logger.warn bad_headers_message return end response.headers["Access-Control-Allow-Headers"] = request_headers if request_headers response.headers["Access-Control-Allow-Methods"] = request_method response.headers["Access-Control-Max-Age"] = settings.max_age if settings.max_age? else response.headers["Access-Control-Expose-Headers"] = settings.expose_headers if settings.expose_headers? end response.headers["Access-Control-Allow-Origin"] = request.env["HTTP_ORIGIN"] response.headers["Access-Control-Allow-Credentials"] = settings.allow_credentials.to_s if settings.allow_credentials? end end
headers_are_allowed?()
click to toggle source
# File lib/sinatra/cors.rb, line 51 def headers_are_allowed? allow_headers = settings.allow_headers request_headers = request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"] || "" (request_headers.downcase.split(/\s*,\s*/) - allow_headers.downcase.split(/\s*,\s*/)).empty? end
is_cors_request?()
click to toggle source
# File lib/sinatra/cors.rb, line 36 def is_cors_request? request.env.has_key? "HTTP_ORIGIN" end
is_preflight_request?()
click to toggle source
# File lib/sinatra/cors.rb, line 40 def is_preflight_request? request.env["REQUEST_METHOD"] == "OPTIONS" end
method_is_allowed?()
click to toggle source
# File lib/sinatra/cors.rb, line 44 def method_is_allowed? allow_methods = settings.allow_methods.upcase.split(/\s*,\s*/) & response.headers["Allow"].upcase.split(/\s*,\s*/) allow_methods.include? request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"].upcase end
origin_is_allowed?()
click to toggle source
# File lib/sinatra/cors.rb, line 57 def origin_is_allowed? request_origin = request.env["HTTP_ORIGIN"] settings.allow_origin == "*" || [settings.allow_origin] .flatten .flat_map { |origin| origin.is_a?(String) ? origin.downcase.split : origin } .any? do |origin| if origin.is_a?(Regexp) origin.match?(request_origin) else origin.eql?(request_origin) end end end
request_headers()
click to toggle source
# File lib/sinatra/cors.rb, line 85 def request_headers request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"] end
request_method()
click to toggle source
# File lib/sinatra/cors.rb, line 89 def request_method request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"] end
Private Instance Methods
bad_headers_message()
click to toggle source
# File lib/sinatra/cors.rb, line 102 def bad_headers_message "This CORS preflight request was rejected because the client is asking permission to make a \ request with the headers '#{request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]}', but the server \ only allows requests with the headers '#{settings.allow_headers}'. To allow the server to respond \ to requests with these headers, you can add them to the `allow_headers` sinatra setting." end
bad_method_message()
click to toggle source
# File lib/sinatra/cors.rb, line 95 def bad_method_message "This CORS preflight request was rejected because the client is asking permission to make a \ '#{request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"]}' request, but the server only allows \ '#{settings.allow_methods}' requests. To allow the server to respond to this request method, add it \ to the `allow_methods` sinatra setting." end
bad_origin_message()
click to toggle source
# File lib/sinatra/cors.rb, line 109 def bad_origin_message "This CORS request was rejected because the client is making the request from \ '#{request.env["HTTP_ORIGIN"]}', but the server only allows requests from '#{settings.allow_origin}'. \ To allow the server to respond to requests from this origin, you can add it to the `allow_origin` \ sinatra setting." end