如何在rails下的webrick中设置access-control-allow-origin？

Question

我已经编写了一个小型rails应用程序,通过xmlhttprequests向另一个站点提供内容,这些站点将在另一个域上运行(无法让它们在同一台服务器上运行).我知道我需要在我的rails服务器上设置access-control-allow-origin,以允许请求的网页访问这些资料.

似乎有很好的文档说明如何使用Apache,这可能是我部署网站后将使用的服务器.虽然我正在开发,但我希望只使用webrick,因为我习惯使用rails.有没有办法配置webrick以在rails中提供适当的http标头？

Answer 1

Rails 4(http://edgeguides.rubyonrails.org/security.html#default-headers)

在config/application.rb中:

config.action_dispatch.default_headers.merge!({
  'Access-Control-Allow-Origin' => '*',
  'Access-Control-Request-Method' => '*'
})

Answer 2

Rails 3.1

class ApplicationController < ActionController::Base
  protect_from_forgery
  after_filter :set_access_control_headers

  def set_access_control_headers
    headers['Access-Control-Allow-Origin'] = '*'
    headers['Access-Control-Request-Method'] = '*'
  end
end

Answer 3

如果您使用的是Rails 2,只需将其添加到应用程序控制器即可.

before_filter :set_access

def set_access
  @response.headers["Access-Control-Allow-Origin"] = "*"
end

显然,改变"*"一些不那么开放的东西是个好主意.

Answer 4

Rails 3.1 - 使用控制器after_filter对我不起作用所以我添加了一个自定义中间件:

在app/middleware/cors_middleware.rb中:

# For icons to work in Firefox with CDN
class CorsMiddleware
  def initialize(app)
    @app = app
  end

  def call(env)
    status, headers, body = @app.call(env)
    cors_headers = headers.merge({
      'Access-Control-Allow-Origin' => '*',
      'Access-Control-Request-Method' => '*'        
    })
    [status, cors_headers, body]
  end  
end

在config/application.rb中:

require File.join(Rails.root, "app", "middleware", "cors_middleware")
config.middleware.insert_before ActionDispatch::Static, CorsMiddleware # Need it early in the chain to work for assets

Answer 5

Rails 2.3.8

before_filter :allow_cross_domain_access
def allow_cross_domain_access
  response.headers["Access-Control-Allow-Origin"] = "*"
  response.headers["Access-Control-Allow-Methods"] = "*"
end

Answer 6

如果您希望将解决方案作为Rack中间件gem:https: //github.com/cyu/rack-cors