Class: Tina4::CorsClassMiddleware

Inherits:
Object
  • Object
show all
Defined in:
lib/tina4/middleware.rb

Overview

CorsClassMiddleware -- sets CORS headers from env vars on every response.

A thin adapter over Tina4::CorsMiddleware, which owns the whole policy. It used to be a SECOND, independent implementation of the same rules and the two had already drifted: this copy had no wildcard/credentials guard, fell back to the Referer header (a full URL, not an origin), and on an allow-list MISS returned allowed.first - stamping some OTHER allowed origin onto the response of an origin that was not allowed at all. One feature, one implementation.

Class Method Summary collapse

Class Method Details

.before_cors(request, response) ⇒ Object 



427
428
429
430
431
432
433
434
435
 
# File 'lib/tina4/middleware.rb', line 427

def before_cors(request, response)
  env = request.respond_to?(:env) && request.env ? request.env : {}
  origin = request.headers["origin"] if request.respond_to?(:headers)
  env = env.merge("HTTP_ORIGIN" => origin) if origin

  Tina4::CorsMiddleware.apply_headers(response.headers, env)

  [request, response]
end