From b05d14a85178ed1f0cef350ef79137edc1137b6a Mon Sep 17 00:00:00 2001 From: rhymes Date: Tue, 18 Feb 2020 19:37:54 +0100 Subject: [PATCH] Enable CORS preflight caching (#6153) [deploy] --- config/application.rb | 6 ++++-- spec/requests/api/v0/articles_spec.rb | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/config/application.rb b/config/application.rb index a5cf87907..bb110fa5d 100644 --- a/config/application.rb +++ b/config/application.rb @@ -69,8 +69,10 @@ module PracticalDeveloper # allowed public APIs %w[articles comments listings podcast_episodes tags users videos].each do |resource_name| - # allow read operations, disallow custom headers (eg. api-key) and disable preflight caching - resource "/api/#{resource_name}/*", methods: %i[head get options], headers: [], max_age: -1 + # allow read operations, disallow custom headers (eg. api-key) and enable preflight caching + # NOTE: Chrome caps preflight caching at 2 hours, Firefox at 24 hours + # see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age#Directives + resource "/api/#{resource_name}/*", methods: %i[head get options], headers: [], max_age: 2.hours.to_i end end end diff --git a/spec/requests/api/v0/articles_spec.rb b/spec/requests/api/v0/articles_spec.rb index 15af06af0..c6821dbb5 100644 --- a/spec/requests/api/v0/articles_spec.rb +++ b/spec/requests/api/v0/articles_spec.rb @@ -13,7 +13,7 @@ RSpec.describe "Api::V0::Articles", type: :request do expect(response.headers["Access-Control-Allow-Origin"]).to eq(origin) expect(response.headers["Access-Control-Allow-Methods"]).to eq("HEAD, GET, OPTIONS") expect(response.headers["Access-Control-Expose-Headers"]).to be_empty - expect(response.headers["Access-Control-Max-Age"]).to be_present + expect(response.headers["Access-Control-Max-Age"]).to eq(2.hours.to_i.to_s) end it "has correct keys in the response" do @@ -271,7 +271,7 @@ RSpec.describe "Api::V0::Articles", type: :request do expect(response.headers["Access-Control-Allow-Origin"]).to eq(origin) expect(response.headers["Access-Control-Allow-Methods"]).to eq("HEAD, GET, OPTIONS") expect(response.headers["Access-Control-Expose-Headers"]).to be_empty - expect(response.headers["Access-Control-Max-Age"]).to be_present + expect(response.headers["Access-Control-Max-Age"]).to eq(2.hours.to_i.to_s) end it "has correct keys in the response" do