module Sinatra::CrossOrigin::Helpers

Public Instance Methods

cross_origin(hash=nil) click to toggle source

Apply cross origin headers either from global config or custom config passed as a hash

# File lib/sinatra/cross_origin.rb, line 28
def cross_origin(hash=nil)
  request_origin = request.env['HTTP_ORIGIN']
  return unless request_origin
  settings.set hash if hash

  if settings.allow_origin == :any
    origin = request_origin
  else
    allowed_origins = *settings.allow_origin # make sure its an array
    origin = allowed_origins.join('|')       # we'll return this unless allowed

    allowed_origins.each do |allowed_origin|
      if allowed_origin.is_a?(Regexp) ? 
          request_origin =~ allowed_origin : 
          request_origin == allowed_origin
        origin = request_origin
        break
      end
    end
  end

  methods = settings.allow_methods.map{ |m| m.to_s.upcase! }.join(', ')

  headers_list = {
    'Access-Control-Allow-Origin' => origin,
    'Access-Control-Allow-Methods' => methods,
    'Access-Control-Allow-Headers' => settings.allow_headers.map(&:to_s).join(', '),
    'Access-Control-Allow-Credentials' => settings.allow_credentials.to_s,
    'Access-Control-Max-Age' => settings.max_age.to_s,
    'Access-Control-Expose-Headers' => settings.expose_headers.join(', ')
  }

  headers headers_list
end