Module: Charcoal::Utilities

Included in:
CrossOriginController
Defined in:
lib/charcoal/utilities.rb

Constant Summary collapse

FORBIDDEN_CORS_METHODS =

OPTIONS is the preflight question, not an answer. CONNECT/TRACE/TRACK are "forbidden methods" the browser won't send cross-origin. See https://fetch.spec.whatwg.org/#forbidden-method

%w[OPTIONS CONNECT TRACE TRACK].freeze
WEBDAV_METHODS =

WebDAV / versioning families (PROPFIND, MKCOL, REPORT, …): recognized by Rails but never sent cross-origin. These are the RFC groups ActionDispatch concatenates to build HTTP_METHODS.

[
  *ActionDispatch::Request::RFC2518,
  *ActionDispatch::Request::RFC3253,
  *ActionDispatch::Request::RFC3648,
  *ActionDispatch::Request::RFC3744,
  *ActionDispatch::Request::RFC5323,
  *ActionDispatch::Request::RFC4791
].freeze
HTTP_METHODS =

Verbs advertised in Access-Control-Allow-Methods.

(ActionDispatch::Request::HTTP_METHODS - FORBIDDEN_CORS_METHODS - WEBDAV_METHODS)
.map { |v| v.downcase.to_sym }.freeze

Instance Method Summary collapse

Instance Method Details

#allowed_methods_for?(protocol) ⇒ Boolean

Returns:

  • (Boolean) 


26
27
28
29
30
 
# File 'lib/charcoal/utilities.rb', line 26

def allowed_methods_for?(protocol)
  @allowed_methods ||= {}
  return @allowed_methods[protocol] if @allowed_methods[protocol]
  @allowed_methods[protocol] = methods_allowed_for?(protocol)
end