maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable CORS preflight caching (#6153) [deploy]

Browse source
This commit is contained in:
rhymes 2020-02-18 19:37:54 +01:00 • committed by GitHub
parent 2c6fc937cd
commit b05d14a851
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
config/application.rb
View file

@ -69,8 +69,10 @@ module PracticalDeveloper
# allowed public APIs
%w[articles comments listings podcast_episodes tags users videos].each do |resource_name|
# allow read operations, disallow custom headers (eg. api-key) and disable preflight caching
resource "/api/#{resource_name}/*", methods: %i[head get options], headers: [], max_age: -1
# allow read operations, disallow custom headers (eg. api-key) and enable preflight caching
# NOTE: Chrome caps preflight caching at 2 hours, Firefox at 24 hours
# see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age#Directives
resource "/api/#{resource_name}/*", methods: %i[head get options], headers: [], max_age: 2.hours.to_i
end
end
end

4
spec/requests/api/v0/articles_spec.rb
View file

@ -13,7 +13,7 @@ RSpec.describe "Api::V0::Articles", type: :request do
expect(response.headers["Access-Control-Allow-Origin"]).to eq(origin)
expect(response.headers["Access-Control-Allow-Methods"]).to eq("HEAD, GET, OPTIONS")
expect(response.headers["Access-Control-Expose-Headers"]).to be_empty
expect(response.headers["Access-Control-Max-Age"]).to be_present
expect(response.headers["Access-Control-Max-Age"]).to eq(2.hours.to_i.to_s)
end
it "has correct keys in the response" do
@ -271,7 +271,7 @@ RSpec.describe "Api::V0::Articles", type: :request do
expect(response.headers["Access-Control-Allow-Origin"]).to eq(origin)
expect(response.headers["Access-Control-Allow-Methods"]).to eq("HEAD, GET, OPTIONS")
expect(response.headers["Access-Control-Expose-Headers"]).to be_empty
expect(response.headers["Access-Control-Max-Age"]).to be_present
expect(response.headers["Access-Control-Max-Age"]).to eq(2.hours.to_i.to_s)
end
it "has correct keys in the response" do