module Sinatra::Cors::Helpers

Public Instance Methods

allowed_methods() click to toggle source
# File lib/sinatra/cors.rb, line 72
def allowed_methods
  matches = []
  settings.routes.each do |method, routes|
    routes.each do |route|
      process_route(route[0], route[1]) do |application, pattern|
        matches << method
      end
    end
  end

  matches.uniq
end
cors() click to toggle source
# File lib/sinatra/cors.rb, line 6
def cors
  if is_cors_request?
    unless origin_is_allowed?
      logger.warn bad_origin_message
      return
    end

    if is_preflight_request?
      unless method_is_allowed?
        logger.warn bad_method_message
        return
      end

      unless headers_are_allowed?
        logger.warn bad_headers_message
        return
      end

      response.headers["Access-Control-Allow-Headers"] = request_headers if request_headers
      response.headers["Access-Control-Allow-Methods"] = request_method
      response.headers["Access-Control-Max-Age"] = settings.max_age if settings.max_age?
    else
      response.headers["Access-Control-Expose-Headers"] = settings.expose_headers if settings.expose_headers?
    end

    response.headers["Access-Control-Allow-Origin"] = request.env["HTTP_ORIGIN"]
    response.headers["Access-Control-Allow-Credentials"] = settings.allow_credentials.to_s if settings.allow_credentials?
  end
end
headers_are_allowed?() click to toggle source
# File lib/sinatra/cors.rb, line 51
def headers_are_allowed?
  allow_headers = settings.allow_headers
  request_headers = request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"] || ""
  (request_headers.downcase.split(/\s*,\s*/) - allow_headers.downcase.split(/\s*,\s*/)).empty?
end
is_cors_request?() click to toggle source
# File lib/sinatra/cors.rb, line 36
def is_cors_request?
  request.env.has_key? "HTTP_ORIGIN"
end
is_preflight_request?() click to toggle source
# File lib/sinatra/cors.rb, line 40
def is_preflight_request?
  request.env["REQUEST_METHOD"] == "OPTIONS"
end
method_is_allowed?() click to toggle source
# File lib/sinatra/cors.rb, line 44
def method_is_allowed?
  allow_methods =
    settings.allow_methods.upcase.split(/\s*,\s*/) &
    response.headers["Allow"].upcase.split(/\s*,\s*/)
  allow_methods.include? request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"].upcase
end
origin_is_allowed?() click to toggle source
# File lib/sinatra/cors.rb, line 57
def origin_is_allowed?
  request_origin = request.env["HTTP_ORIGIN"]

  settings.allow_origin == "*" || [settings.allow_origin]
    .flatten
    .flat_map { |origin| origin.is_a?(String) ? origin.downcase.split : origin }
    .any? do |origin|
      if origin.is_a?(Regexp)
        origin.match?(request_origin)
      else
        origin.eql?(request_origin)
      end
    end
end
request_headers() click to toggle source
# File lib/sinatra/cors.rb, line 85
def request_headers
  request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]
end
request_method() click to toggle source
# File lib/sinatra/cors.rb, line 89
def request_method
  request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"]
end

Private Instance Methods

bad_headers_message() click to toggle source
# File lib/sinatra/cors.rb, line 102
      def bad_headers_message
        "This CORS preflight request was rejected because the client is asking permission to make a \
request with the headers '#{request.env["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"]}', but the server \
only allows requests with the headers '#{settings.allow_headers}'.  To allow the server to respond \
to requests with these headers, you can add them to the `allow_headers` sinatra setting."
      end
bad_method_message() click to toggle source
# File lib/sinatra/cors.rb, line 95
      def bad_method_message
        "This CORS preflight request was rejected because the client is asking permission to make a \
'#{request.env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"]}' request, but the server only allows \
'#{settings.allow_methods}' requests.  To allow the server to respond to this request method, add it \
to the `allow_methods` sinatra setting."
      end
bad_origin_message() click to toggle source
# File lib/sinatra/cors.rb, line 109
      def bad_origin_message
        "This CORS request was rejected because the client is making the request from \
'#{request.env["HTTP_ORIGIN"]}', but the server only allows requests from '#{settings.allow_origin}'.  \
To allow the server to respond to requests from this origin, you can add it to the `allow_origin` \
sinatra setting."
      end