How to set access-control-allow-origin in webrick under rails?

I have written a small rails app to serve up content to another site via xmlhttprequests that will be operating from another domain (it will not be possible to get them running on the same server). I understand I will need to set access-control-allow-origin on my rails server to allow the requesting web page to access this material.

It seems fairly well documented how to do this with Apache and this is probably the server I will use once I deploy the site. While I am developing though I hope to just use webrick as I am used to doing with rails. Is there a way of configuring webrick to provide the appropriate http header within rails?

Answers


If you're on Rails 2 just add this to your application contoller.

before_filter :set_access

def set_access
  @response.headers["Access-Control-Allow-Origin"] = "*"
end

Obviously changing "*" to something a little less open would be a good idea.


Rails 4 (http://edgeguides.rubyonrails.org/security.html#default-headers)

In config/application.rb:

config.action_dispatch.default_headers.merge!({
  'Access-Control-Allow-Origin' => '*',
  'Access-Control-Request-Method' => '*'
})

Rails 3.1

class ApplicationController < ActionController::Base
  protect_from_forgery
  after_filter :set_access_control_headers

  def set_access_control_headers
    headers['Access-Control-Allow-Origin'] = '*'
    headers['Access-Control-Request-Method'] = '*'
  end
end

Rails 3.1 - using a controller after_filter did not work for me so I added a custom middleware instead:

In app/middleware/cors_middleware.rb:

# For icons to work in Firefox with CDN
class CorsMiddleware
  def initialize(app)
    @app = app
  end

  def call(env)
    status, headers, body = @app.call(env)
    cors_headers = headers.merge({
      'Access-Control-Allow-Origin' => '*',
      'Access-Control-Request-Method' => '*'        
    })
    [status, cors_headers, body]
  end  
end

In config/application.rb:

require File.join(Rails.root, "app", "middleware", "cors_middleware")
config.middleware.insert_before ActionDispatch::Static, CorsMiddleware # Need it early in the chain to work for assets

Rails 2.3.8

before_filter :allow_cross_domain_access
def allow_cross_domain_access
  response.headers["Access-Control-Allow-Origin"] = "*"
  response.headers["Access-Control-Allow-Methods"] = "*"
end

In case you want the solution as a Rack middleware gem: https://github.com/cyu/rack-cors


Need Your Help

JComboBox and JList

java list combobox

I having trouble of what to put in the actionPerformed for the Combo Box. My problem is when I select an Item from the Combo Box it will show a List.

Validation Of Date Field

javascript validation

I have a date field on a form. The date in the date field has to be after today's date and not in the past. It also has to be within 30 days from today's date. So if today is 15/01/2013, then the f...