about summary refs log tree commit diff
path: root/app/controllers
diff options
context:
space:
mode:
authorEugen Rochko <eugen@zeonfederated.com>2016-11-02 12:57:14 +0100
committerEugen Rochko <eugen@zeonfederated.com>2016-11-02 12:58:15 +0100
commit9467b900a27fd646952cbf37f7542765881dceac (patch)
treec124c4ffb50190d7e876d354f3e1ded8ca650d51 /app/controllers
parent0a6b5e2c17be11c431d5b5b3d188db7e5021d914 (diff)
Make cookies https-only if LOCAL_HTTPS is true, set X-Frame-Options to DENY,
add permissive CORS to API controllers
Diffstat (limited to 'app/controllers')
-rw-r--r--app/controllers/api_controller.rb8
1 files changed, 8 insertions, 0 deletions
diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index 0776f4ce8..273aaff85 100644
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -4,6 +4,7 @@ class ApiController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   before_action :set_rate_limit_headers
+  before_action :set_cors_headers
 
   rescue_from ActiveRecord::RecordInvalid do |e|
     render json: { error: e.to_s }, status: 422
@@ -46,6 +47,13 @@ class ApiController < ApplicationController
     response.headers['X-RateLimit-Reset']     = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
   end
 
+  def set_cors_headers
+    response.headers['Access-Control-Allow-Origin']   = '*'
+    response.headers['Access-Control-Allow-Methods']  = 'POST, PUT, DELETE, GET, OPTIONS'
+    response.headers['Access-Control-Request-Method'] = '*'
+    response.headers['Access-Control-Allow-Headers']  = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
+  end
+
   def current_resource_owner
     User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
   end