CORS with Rails

Presented at December 2015 meetup of Rorosyd - Ruby or Rails User Group Sydney
https://www.meetup.com/Ruby-On-Rails-Oceania-Sydney/events/225087753/

Transcript

1. Cross-origin resource sharing (CORS) With Rails Qing Wu @wiserfirst
2. Why we need it API service on api.example.com Main site (front end) on www.example.com Make Ajax requests from the front end
3. Oops…
4. Same-origin policy "Cross-domain" Ajax requests are forbidden Prevent XSS and other security issues Ref: Same-origin policy on Wikipedia
5. The brick walls are there for a reason. The brick walls are not there to keep us out. The brick walls are there to give us a chance to show how badly we want something. Because the brick walls are there to stop the people who don’t want it badly enough. They’re there to stop the other people. — Randy Pausch, The Last Lecture
6. Cross-origin resource sharing 1. Browser send OPTIONS request with Origin header (http://www.example.com) 2. The server respond with Access-Control- Allow-Origin header 3. If match, continue with actual request; otherwise no request is made Ref: CORS on Wikipedia
7. CORS with Rails Respond to the OPTIONS requests to every API endpoints Set appropriate headers (Origin, methods, headers) as needed
8. Set the route namespace :api do resources :movies, :users # for the preflight request. Last route under /api match "*path" => "base#preflight_check", via: [:options] end
9. Set headers for requests # Api::BaseController before_action :authenticate, :except => [:preflight_check] after_action :cors_set_access_control_headers def preflight_check if request.method == 'OPTIONS' render :text => '', :content_type => 'text/plain' end end
10. Set headers for requests def cors_set_access_control_headers headers['Access-Control-Allow-Origin'] = 'http://www.example.com' headers['Access-Control-Allow-Methods'] = 'POST, PATCH, DELETE, OPTIONS' headers['Access-Control-Allow-Headers'] = 'X-MYCUSTOM-HEADER' headers['Access-Control-Max-Age'] = '10' # in seconds end
11. References StackOverflow answer: Allow anything through CORS Policy Gist: CORS in Rails 4 APIs Rack Middleware: Rack::Cors
12. My implementation https://gist.github.com/wiserfirst/ db902e58ccd756ccc019 Or https://goo.gl/TSXncO
13. Alternatives to CORS Same origin (not always feasible) JSONP (limited to GET; works on legacy browsers) Cross-document messaging
14. Any Questions?