I'm creating a set of services using Rails 4, which I am consuming with a JavaScript browser application. Cross-origin GETS are working fine, but my POSTs are failing the preflight OPTIONS check with a 404 error. At least, I think that's what's happening. Here are the errors as they appear in the console. This is Chrome 31.0.1650.63 on a Mac.
OPTIONS http://localhost:3000/confessor_requests 404 (Not Found) jquery-1.10.2.js:8706 OPTIONS http://localhost:3000/confessor_requests No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. jquery-1.10.2.js:8706 XMLHttpRequest cannot load http://localhost:3000/confessor_requests. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. main.html:1
I've searched high and low for instructions on enabling CORS, and I'm stumped. The usual recommendation seems to be to put something like this in the Application controller, which I did.
before_filter :cors_preflight_check after_filter :cors_set_access_control_headers def cors_set_access_control_headers headers['Access-Control-Allow-Origin'] = '*' headers['Access-Control-Allow-Methods'] = 'POST, PUT, GET, OPTIONS' headers['Access-Control-Allow-Headers'] = '*' headers['Access-Control-Max-Age'] = "1728000" end def cors_preflight_check if request.method == :options headers['Access-Control-Allow-Origin'] = '*' headers['Access-Control-Allow-Methods'] = 'POST, PUT, GET, OPTIONS' headers['Access-Control-Allow-Headers'] = '*' headers['Access-Control-Max-Age'] = '1728000' render :text => '', :content_type => 'text/plain' end end
Followed by some kind of route in routes.rb that will redirect to this action when an OPTIONS request comes in.
match "/*all" => "application#cors_preflight_check", :constraints => { :method => "OPTIONS" }
The 'match' directive no longer works in Rails 4, so I fiddled with it, attempting to make it match POSTS directly, like this:
post "/*all" => "application#cors_preflight_check", :constraints => { :method => :options }
But it still doesn't work. Since the GET requests are working, I'm assuming that what I'm missing is the correct route for the OPTIONS request. However, I've tried every route I can think of, and nothing seems to let the request through.
I also tried installing cyu/rack-cors, and this gives the same result.
Anyone know what I'm doing wrong?
A CORS preflight OPTIONS request can be triggered just by adding a Content-Type header to a request — if the value's anything except application/x-www-form-urlencoded , text/plain , or multipart/form-data .
Check for the existence of these essential information present in a preflight request: The request's HTTP method is OPTIONS. It has an Origin header. It has an Access-Control-Request-Method header, indicating what's the actual method it's trying to use to consume your service/resource.
Here's a solution with the rack-cors gem, which you said you tried. As others have mentioned, you didn't give much detail in regards to which front-end framework you're using and what the actual request looks like. So the following may not apply to you, but I hope it helps someone.
In my case, the gem worked fine until I used PUT (or PATCH or DELETE).
If you look in your browser developer console, look at the request headers, and you should have a line like this:
Access-Control-Request-Method: PUT
The important thing to note is that the methods
you pass to resource
are for the Access-Control-Request-Method
, not the Request Method that is to come after the pre-flight check.
Note how I have :methods => [:get, :post, :options, :delete, :put, :patch]
that will include all the methods I care about.
Thus your entire config section should look something like this, for development.rb
:
# This handles cross-origin resource sharing. # See: https://github.com/cyu/rack-cors config.middleware.insert_before 0, "Rack::Cors" do allow do # In development, we don't care about the origin. origins '*' # Reminder: On the following line, the 'methods' refer to the 'Access- # Control-Request-Method', not the normal Request Method. resource '*', :headers => :any, :methods => [:get, :post, :options, :delete, :put, :patch], credentials: true end end
Working on Rails 3.2.11.
I put
match '*path', :controller => 'application', :action => 'handle_options_request', :constraints => {:method => 'OPTIONS'}
in my routes.rb file. The key was to put it as top priority (on top of the routes.rb file). Created that action so that it is publicly available:
def handle_options_request head(:ok) if request.request_method == "OPTIONS" end
And a filter in application controller:
after_filter :set_access_control_headers def set_access_control_headers headers['Access-Control-Allow-Origin'] = '*' headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE' end
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With