Restrict CORS to API only

Previously this was missing the leading slash
cyclestreets · Aug 13, 2018 · a2906f6 · a2906f6
1 parent a59913a
commit a2906f6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/initializers/cors.rb b/config/initializers/cors.rb
@@ -5,7 +5,7 @@ class Application < Rails::Application
     config.middleware.insert_before 0, "Rack::Cors" do
       allow do
         origins '*'
-        resource '*', headers: :any, methods: [:get, :post, :options], credentials: false
+        resource '/api/*', headers: :any, methods: [:get, :post, :options], credentials: false
       end
     end
   end