Allow anything through CORS Policy

Question

How can I disable cors? For some reason I wild carded the allowed origins and headers yet my ajax requests still complain that the origin was not allowed by my CORS policy....

My applications controller :

class ApplicationController < ActionController::Base   protect_from_forgery   before_filter :current_user, :cors_preflight_check   after_filter :cors_set_access_control_headers  # For all responses in this controller, return the CORS access control headers.  def cors_set_access_control_headers   headers['Access-Control-Allow-Origin'] = '*'   headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'   headers['Access-Control-Allow-Headers'] = '*'   headers['Access-Control-Max-Age'] = "1728000" end  # If this is a preflight OPTIONS request, then short-circuit the # request, return only the necessary headers and return an empty # text/plain.  def cors_preflight_check   if request.method == :options     headers['Access-Control-Allow-Origin'] = '*'     headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'     headers['Access-Control-Allow-Headers'] = '*'     headers['Access-Control-Max-Age'] = '1728000'     render :text => '', :content_type => 'text/plain'   end end   private   # get the user currently logged in   def current_user     @current_user ||= User.find(session[:user_id]) if session[:user_id]   end   helper_method :current_user  end 

routes:

  match "*all" => "application#cors_preflight_check", :constraints => { :method => "OPTIONS" }   match "/alert" => "alerts#create"   match "/alerts" => "alerts#get"   match "/login" => "sessions#create"   match "/logout" => "sessions#destroy"   match "/register" => "users#create" 

Edit---

I also tried:

   config.middleware.use Rack::Cors do       allow do         origins '*'         resource '*',              :headers => :any,              :methods => [:get, :post, :delete, :put, :options]       end     end 

in application.rb

--edit 2---

The problem is that Chrome Extensions may not support CORS I think. How can I fetch information bypassing CORS? How should I respond to the preflight check?

Answer 1

I've your same requirements on a public API for which I used rails-api.

I've also set header in a before filter. It looks like this:

headers['Access-Control-Allow-Origin'] = '*' headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS' headers['Access-Control-Request-Method'] = '*' headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization' 

It seems you missed the Access-Control-Request-Method header.

Answer 2

Have a look at the rack-cors middleware. It will handle CORS headers in a configurable manner.