Where do I apply an 'Access-Control-Allow-Origin' header in a rails application

Question

I am trying to link to a third party authentication page via omniauth in a rails app using ember.js as a client. I am able to redirect my server to the proper url, but I cannot send my client there (causing my server to hang indefinitely in the request phase). My problem is that I need to set the Access-Control-Allow-Origin header somewhere in my application, but I am not sure where. I currently have this (non-working) setup in my application_controller.rb:

class ApplicationController < ActionController::API
  # Force to wants JSON for API
  before_action :api_request_settings, :cors_preflight_check

  after_action :cors_set_access_control_headers

  def cors_preflight_check
    p 'hits cors preflight check'
    if request.method == :options
      headers['Access-Control-Allow-Origin'] = '*'
      headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'
      headers['Access-Control-Allow-Headers'] = '*'
      headers['Access-Control-Request-Method'] = '*'
      headers['Access-Control-Max-Age'] = '1728000'
      render :text => '', :content_type => 'text/plain'
    end
  end

  def api_request_settings
    p request.headers
    request.format = :json
  end

  def cors_set_access_control_headers
    p 'hits cors acces set control headers'
    headers['Access-Control-Allow-Origin'] = '*'
    headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS'
    headers['Access-Control-Allow-Headers'] = '*'
    headers['Access-Control-Request-Method'] = '*'
    headers['Access-Control-Max-Age'] = "1728000"
  end

What am I doing wrong and where should I put these headers to send my client to the landing page?

Possible duplicate of [How do you add a custom http header?](https://stackoverflow.com/questions/16654052/how-do-you-add-a-custom-http-header) — Eyeslandic, Jun 26 '17 at 00:04

score 0 · Answer 1 · answered Jun 26 '17 at 11:33

0

We are using a GEM that handles it in rack: https://github.com/cyu/rack-cors

answered Jun 26 '17 at 11:33

Tim Lawrenz

338
1
6

I'm using this gem. I actually think the problem is on the client side, in that the origin of the third party API I am trying to redirect to an external authorization url. [Here](https://stackoverflow.com/questions/44751361/making-a-cross-domain-request-in-ember-js-using-an-adapter?noredirect=1#comment76484532_44751361) is the current state of my problem – d00medman Jun 26 '17 at 14:49

Where do I apply an 'Access-Control-Allow-Origin' header in a rails application

1 Answers1