Origin http://localhost is not allowed by Access-Control-Allow-Origin Rails 3

Question

Follow by this question How to set access-control-allow-origin in webrick under rails?, I can GET and POST from the localhost to the localhost:3000.

However, the error occurred with DELETE and PUT

This is how i allow to cross domain access

class ApplicationController < ActionController::Base
    protect_from_forgery
    before_filter :allow_cross_domain_access
    def allow_cross_domain_access
        response.headers["Access-Control-Allow-Origin"] = "*"
        response.headers["Access-Control-Allow-Methods"] = "*"
    end
end

Any idea how to fix it?

Answer 1

* is not a valid value for the Access-Control-Allow-Methods response header. You need to list the actual methods:

response.headers["Access-Control-Allow-Methods"] = "GET, PUT, POST, DELETE"

Also if your request has any custom request headers, you will need to list those as well:

response.headers["Access-Control-Allow-Headers"] = "Content-Type, X-Requested-With"

Lastly note that your controller should allow OPTIONS http requests. This is to allow CORS preflight requests, which are required when making PUT or DELETE requests.

Answer 2

This solution (http://www.tsheffler.com/blog/?p=428) works for me:

before_filter :cors_preflight_check
after_filter :cors_set_access_control_headers

# For all responses in this controller, return the CORS access control headers.

def cors_set_access_control_headers
  headers['Access-Control-Allow-Origin'] = '*'
  headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'
  headers['Access-Control-Max-Age'] = "1728000"
end

# If this is a preflight OPTIONS request, then short-circuit the
# request, return only the necessary headers and return an empty
# text/plain.

def cors_preflight_check
  if request.method == :options
    headers['Access-Control-Allow-Origin'] = '*'
    headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'
    headers['Access-Control-Allow-Headers'] = 'X-Requested-With, X-Prototype-Version'
    headers['Access-Control-Max-Age'] = '1728000'
    render :text => '', :content_type => 'text/plain'
  end
end

Also, probably you want to enable CORS in selected methods:

before_filter :cors_preflight_check, :only => [ :my_method]
after_filter :cors_set_access_control_headers, :only => [ :my_method]

I hope it helps