All CORS routes need to accept CORS simple headers at all times {developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers}
# File lib/rack/cors.rb, line 28 def initialize(app, opts={}, &block) @app = app @debug_mode = !!opts[:debug] @logger = @logger_proc = nil if logger = opts[:logger] if logger.respond_to? :call @logger_proc = opts[:logger] else @logger = logger end end if block_given? if block.arity == 1 block.call(self) else instance_eval(&block) end end end
# File lib/rack/cors.rb, line 54 def allow(&block) all_resources << (resources = Resources.new) if block.arity == 1 block.call(resources) else resources.instance_eval(&block) end end
# File lib/rack/cors.rb, line 64 def call(env) env[HTTP_ORIGIN] ||= env[HTTP_X_ORIGIN] if env[HTTP_X_ORIGIN] path = evaluate_path(env) add_headers = nil if env[HTTP_ORIGIN] debug(env) do [ 'Incoming Headers:', " Origin: #{env[HTTP_ORIGIN]}", " Path-Info: #{path}", " Access-Control-Request-Method: #{env[HTTP_ACCESS_CONTROL_REQUEST_METHOD]}", " Access-Control-Request-Headers: #{env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS]}" ].join("\n") end if env[REQUEST_METHOD] == OPTIONS and env[HTTP_ACCESS_CONTROL_REQUEST_METHOD] headers = process_preflight(env, path) debug(env) do "Preflight Headers:\n" + headers.collect{|kv| " #{kv.join(': ')}"}.join("\n") end return [200, headers, []] else add_headers = process_cors(env, path) end else Result.miss(env, Result::MISS_NO_ORIGIN) end # This call must be done BEFORE calling the app because for some reason # env[PATH_INFO] gets changed after that and it won't match. (At least # in rails 4.1.6) vary_resource = resource_for_path(path) status, headers, body = @app.call env if add_headers headers = add_headers.merge(headers) debug(env) do add_headers.each_pair do |key, value| if headers.has_key?(key) headers["X-Rack-CORS-Original-#{key}"] = value end end end end # Vary header should ALWAYS mention Origin if there's ANY chance for the # response to be different depending on the Origin header value. # Better explained here: http://www.fastly.com/blog/best-practices-for-using-the-vary-header/ if vary_resource vary = headers[VARY] cors_vary_headers = if vary_resource.vary_headers && vary_resource.vary_headers.any? vary_resource.vary_headers else DEFAULT_VARY_HEADERS end headers[VARY] = ((vary ? ([vary].flatten.map { |v| v.split(/,\s*/) }.flatten) : []) + cors_vary_headers).uniq.join(', ') end if debug? && result = env[RACK_CORS] result.append_header(headers) end [status, headers, body] end
# File lib/rack/cors.rb, line 50 def debug? @debug_mode end
# File lib/rack/cors.rb, line 159 def all_resources @all_resources ||= [] end
# File lib/rack/cors.rb, line 132 def debug(env, message = nil, &block) (@logger || select_logger(env)).debug(message, &block) if debug? end
# File lib/rack/cors.rb, line 153 def evaluate_path(env) path = env[PATH_INFO] path = Rack::Utils.clean_path_info(Rack::Utils.unescape(path)) if path path end
# File lib/rack/cors.rb, line 197 def match_resource(path, env) origin = env[HTTP_ORIGIN] origin_matched = false all_resources.each do |r| if r.allow_origin?(origin, env) origin_matched = true if found = r.match_resource(path, env) return [found, nil] end end end [nil, origin_matched ? Result::MISS_NO_PATH : Result::MISS_NO_ORIGIN] end
# File lib/rack/cors.rb, line 175 def process_cors(env, path) resource, error = match_resource(path, env) if resource Result.hit(env) cors = resource.to_headers(env) cors else Result.miss(env, error) nil end end
# File lib/rack/cors.rb, line 163 def process_preflight(env, path) result = Result.preflight(env) resource, error = match_resource(path, env) unless resource result.miss(error) return {} end return resource.process_preflight(env, result) end
# File lib/rack/cors.rb, line 188 def resource_for_path(path_info) all_resources.each do |r| if found = r.resource_for_path(path_info) return found end end nil end
# File lib/rack/cors.rb, line 136 def select_logger(env) @logger = if @logger_proc logger_proc = @logger_proc @logger_proc = nil logger_proc.call elsif defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger Rails.logger elsif env[RACK_LOGGER] env[RACK_LOGGER] else ::Logger.new(STDOUT).tap { |logger| logger.level = ::Logger::Severity::DEBUG } end end