Rails Responds with 404 on CORS Preflight Options Request

Question

I'm creating a set of services using Rails 4, which I am consuming with a JavaScript browser application. Cross-origin GETS are working fine, but my POSTs are failing the preflight OPTIONS check with a 404 error. At least, I think that's what's happening. Here are the errors as they appear in the console. This is Chrome 31.0.1650.63 on a Mac.

OPTIONS http://localhost:3000/confessor_requests 404 (Not Found) jquery-1.10.2.js:8706 OPTIONS http://localhost:3000/confessor_requests No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. jquery-1.10.2.js:8706 XMLHttpRequest cannot load http://localhost:3000/confessor_requests. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. main.html:1 

I've searched high and low for instructions on enabling CORS, and I'm stumped. The usual recommendation seems to be to put something like this in the Application controller, which I did.

before_filter :cors_preflight_check after_filter :cors_set_access_control_headers  def cors_set_access_control_headers   headers['Access-Control-Allow-Origin'] = '*'   headers['Access-Control-Allow-Methods'] = 'POST, PUT, GET, OPTIONS'   headers['Access-Control-Allow-Headers'] = '*'   headers['Access-Control-Max-Age'] = "1728000" end  def cors_preflight_check   if request.method == :options     headers['Access-Control-Allow-Origin'] = '*'     headers['Access-Control-Allow-Methods'] = 'POST, PUT, GET, OPTIONS'     headers['Access-Control-Allow-Headers'] = '*'     headers['Access-Control-Max-Age'] = '1728000'     render :text => '', :content_type => 'text/plain'   end end 

Followed by some kind of route in routes.rb that will redirect to this action when an OPTIONS request comes in.

match "/*all" => "application#cors_preflight_check", :constraints => { :method => "OPTIONS" } 

The 'match' directive no longer works in Rails 4, so I fiddled with it, attempting to make it match POSTS directly, like this:

post "/*all" => "application#cors_preflight_check", :constraints => { :method => :options } 

But it still doesn't work. Since the GET requests are working, I'm assuming that what I'm missing is the correct route for the OPTIONS request. However, I've tried every route I can think of, and nothing seems to let the request through.

I also tried installing cyu/rack-cors, and this gives the same result.

Anyone know what I'm doing wrong?

Answer 1

Here's a solution with the rack-cors gem, which you said you tried. As others have mentioned, you didn't give much detail in regards to which front-end framework you're using and what the actual request looks like. So the following may not apply to you, but I hope it helps someone.

In my case, the gem worked fine until I used PUT (or PATCH or DELETE).

If you look in your browser developer console, look at the request headers, and you should have a line like this:

Access-Control-Request-Method: PUT 

The important thing to note is that the methods you pass to resource are for the Access-Control-Request-Method, not the Request Method that is to come after the pre-flight check.

Note how I have :methods => [:get, :post, :options, :delete, :put, :patch] that will include all the methods I care about.

Thus your entire config section should look something like this, for development.rb:

# This handles cross-origin resource sharing. # See: https://github.com/cyu/rack-cors config.middleware.insert_before 0, "Rack::Cors" do   allow do     # In development, we don't care about the origin.     origins '*'     # Reminder: On the following line, the 'methods' refer to the 'Access-     # Control-Request-Method', not the normal Request Method.     resource '*', :headers => :any, :methods => [:get, :post, :options, :delete, :put, :patch], credentials: true   end end 

Answer 2

Working on Rails 3.2.11.

I put

match '*path', :controller => 'application', :action => 'handle_options_request', :constraints => {:method => 'OPTIONS'} 

in my routes.rb file. The key was to put it as top priority (on top of the routes.rb file). Created that action so that it is publicly available:

  def handle_options_request     head(:ok) if request.request_method == "OPTIONS"   end 

And a filter in application controller:

 after_filter :set_access_control_headers    def set_access_control_headers     headers['Access-Control-Allow-Origin'] = '*'     headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE'   end