Safari Access-Control-Request-Headers: Origin issue [explained]

[squadette]

When you send CORS request with some header like X-API-Token, Safari 6 and 7 send

Access-Control-Request-Headers: Origin, X-API-Token

with the request. If you have explicit list of headers in your Rack::Cors configuration, you probably don't have Origin header in this list. Well, you should, otherwise it does not work.

Chrome and Firefox do not have this issue, they correctly send Access-Control-Request-Headers: X-API-Token. Also, Safari makes it harder to debug, because CORS-failed requests are not in "Timelines" window (they are in "Resources" window).

I understand that most people probably just use headers: :any and do not bother. We need to a) either explicitly mention this in documentation; b) always allow "Origin" in this list.

WDYT?

[HoracioChavez]

Hi @squadette, is this what you meant by allow origin?

config.middleware.insert_before ActionDispatch::Static, Rack::Cors do
  allow do
    origins ""
    resource "", :headers => [:any, :origin], :methods => [:get, :post, :options]
  end
end

I tried that way, bit it didn't work for me. This is my whole implementation: #33 (comment)

[squadette]

@HoracioChavez, well, if you use :any then you probably don't need anything else (but I don't know, looks like people in other tickets still complain). I don't know because I have explicit list of headers in my app, and it (now) includes "Origin".

The pull-request above probably fixes that.

[coneybeare]

I am still seeing problems in Safari, after trying dozens of the tips and tricks mentioned in the issues here. I have a Stack Overflow question opened on my specific problem here

[cyu]

@coneybeare Your issue is an issue with cross origin frames:

http://stackoverflow.com/questions/25098021/securityerror-blocked-a-frame-with-origin-from-accessing-a-cross-origin-frame

[sudoaza]

Any news about this? simpy :any doesnt seem to work still, maybe i'm needing the expose?

[sandstrom]

I'm doing some issue gardening 🌱🌿 🌷 and came upon this issue. Since it's quite old I just wanted to ask if this is still relevant? If it isn't, maybe we can close this issue?

By closing some old issues we reduce the list of open issues to a more manageable set.