CORS issue: Getting error “No 'Access-Control-Allow-Origin' header is present” when it actually is

Question

I doubt the backend serving my app is important, but if you care, I\'m using rack-cors with a Rails 4.0 app.

Using jQuery, I send my app a PATCH request lik

Answer 1

Here is what I found to solve the issue from older SO posts to deal with csrf issues:

# In application_controller.rb
protect_from_forgery

after_filter :set_csrf_cookie

def set_csrf_cookie
  cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
end

protected

# In Rails 4.2 and above
def verified_request?
  super || valid_authenticity_token?(session, request.headers['X-XSRF-TOKEN'])
end

Answer 2

Exclude Rails CSRF checking in the action ;)

That is, Rails checks for an authenticity token with update/create requests. Within your Rails app, this token is added to all of your forms. But with javascript requests, including it is tricky.

You can skip checking it for an action by adding this to your controller:

skip_before_filter :verify_authenticity_token, :only => [:update]

BTW, your problem had nothing to do with CORS, you were getting a bad error message in the browser. The Rails log tells the real story.

Answer 3

This is some strange stuff.

A) As a trial you should try entering in * as your allowed origin.

B) Is this a whitespace issue? After the colons you don't have spaces in some of the options.

C) This looks like a "preflighted request" (https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS). A preflighted request is one that doesn't use "application/x-www-form-urlencoded," which yours should be. http://api.jquery.com/jquery.ajax/ states the default content type is x-www-form-urlencoded, and you aren't overriding content type. That means there shouldn't need to be 2 requests.

D) As noted above, CSRF might be the issue. I am not a rails person. If it is the issue what you may want to do is attach your CSRF token to all ajax sends like so:

$.ajaxSetup({ 
    beforeSend:function(xhr, settings){
        xhr.setRequestHeader('X-CSRF-Token', '<%= csrf_token_value %>');
    } 
});

There are a few other ways to do this. It depends what your frameworks/libraries need.

Answer 4

You might want to add this to your config/application.rb file:

#config/application.rb
config.middleware.use Rack::Cors do
  allow do
    origins '*'
    resource '/*', :headers => :any, :methods => :patch
  end
end

The resource part is where you define which methods / requests your endpoint can accept!

Hope this helps