Add basic support for access control headers to ActionDispatch::Static #19135

yuki24 · 2015-02-28T23:30:46Z

Now ActionDispatch::Static can accept access control headers such as Access-Control-Allow-Origin. These headers will be set as well as Cache-Control header when a response is delivered. Access control headers can be configured with #config in config/application.rb or config/environments/***.rb:

config.action_dispatch.access_control_headers = {
  "Access-Control-Allow-Origin"      => 'http://rubyonrails.org',
  "Access-Control-Expose-Headers"    => 'X-Other-Custom-Header',
  "Access-Control-Allow-Headers"     => 'X-Another-Custom-Header',
  "Access-Control-Max-Age"           => '42',
  "Access-Control-Allow-Credentials" => 'true',
  "Access-Control-Allow-Methods"     => 'GET'
}

cc/ @schneems

yuki24 · 2015-02-28T23:34:03Z

actionpack/lib/action_dispatch/middleware/static.rb

Although this implementation works, I'm not sure about this interface since Cache-Control is also part of the HTTP headers and the third argument seems redundant. I guess this interface could be justdefault_headers.

schneems · 2015-03-02T17:09:45Z

Ultimately I think it looks good. Let's change some naming so that it's a little more generic. Instead of access_control_headers let's just use headers which is technically what it is (although you can use them as access control headers).

You can reduce the initialization logic to something like this:

headers ||= {}
headers['Cache-Control'] = cache_control

I would also change config.action_dispatch.access_control_headers to config.action_dispatch.asset_headers or something more accurate. We can then explicitly add a section in the guides that shows how to set access control headers http://guides.rubyonrails.org/asset_pipeline.html

I agree we should deprecate some interfaces here and clean some things up. Unfortunately as I understand, the deadline for getting deprecations in to Rails 5 was Rails 4.2.0

yuki24 · 2015-03-03T02:53:56Z

Updated the commit as suggested. Thanks @schneems for reviewing!

yuki24 · 2015-03-03T17:31:42Z

forgot to add a CHANGELOG entry btw. I'll add it tonight.

schneems · 2015-03-03T18:15:37Z

actionpack/lib/action_dispatch/middleware/static.rb

merge and reverse_merge are really expensive. Even though this only gets called once on initialization the code in this file is very performance sensitive and I don't want people copying existing style. Can you also factor out the merge?

Thanks @schneems, removed the merge call,

yuki24 · 2015-03-04T13:33:45Z

actionpack/lib/action_dispatch/railtie.rb

I'm not sure if this is the right place to define public_file_server. I'm open to suggestions.

schneems · 2015-05-21T15:29:32Z

What are we waiting on for this to go in? Anything a blocker here?

yuki24 · 2015-06-10T12:10:09Z

railties/lib/rails/application/default_middleware_stack.rb

I needed to use :not_set explicitly due to this change: #20017. I think we should make the index arg a keyword argument so we don't have to care about the order of the args here. Alternatively, we can just merge the static_index config into the public_file_server namespace, which I actually prefer, but I'm open to suggestions.

cc/ @eliotsykes @jonatack

vipulnsward · 2015-06-10T12:21:03Z

actionpack/lib/action_dispatch/middleware/static.rb

index can be kwarg too.

Absolutely. See my comment above about it: #19135 (comment)

I just sent a separate pull request for this: #20520. Now we need to wait on it to be merged before merging this PR.

The comment states optional HTTP headers but the headers keyword is required. Perhaps headers: needs a default value?

Headers are totally optional. I changed it to use a {} by default.

Great.

This PR will break the interface for other services/gems that hook into it, for instance the Heroku-deflator gem here but seems unavoidable for adding this feature.

oh, I didn't know that ActionDispatch::FileHandler is a public class. I don't think it's ok to break it.

I did a little investigation but I'm not sure if we should treat ActionDispatch::FileHandler as a public class. It's basically an inner class. Does it still have to be public?

yuki24 · 2015-06-10T12:27:32Z

@schneems updated the commit. I'm a bit concerned about the arguments of the ActionDispatch::Static initializer, but everything else should be good now.

vipulnsward · 2015-06-10T12:31:02Z

railties/lib/rails/application/configuration.rb

Would be good to have this as-

config.public_file_server.headers= {'Cache-Control' => #{value}}

This would suggest the options being passed to headers have been expanded.

vipulnsward · 2015-06-10T12:36:35Z

@yuki24 Thanks a ton for this, I was looking to implement something similar due to this - https://twitter.com/vipulnsward/status/603866969201373184

Now ActionDispatch::Static can accept HTTP headers so that developers will have control of returning arbitrary headers like 'Access-Control-Allow-Origin' when a response is delivered. They can be configured through `#config.public_file_server.headers`: config.public_file_server.headers = { "Cache-Control" => "public, max-age=60", "Access-Control-Allow-Origin" => "http://rubyonrails.org" } Also deprecate `config.static_cache_control` in favor of `config.public_file_server.headers`.

yuki24 · 2015-06-13T17:09:07Z

I believe everything should be good and we are ready to merge.

schneems · 2015-10-13T18:09:33Z

I spoke to @jeremy, I think it just fell off his radar. Can you rebase, this is good to merge.

jeremy · 2015-10-13T18:18:03Z

👍 Looks like a changelog conflict only, no need to rebase.

Add basic support for access control headers to ActionDispatch::Static

yuki24 · 2015-10-15T10:51:06Z

@schneems @jeremy Thanks! ❤️ 💟 💛 💙 ❤️ 💟 💛 💙

kaspth · 2015-11-03T14:16:23Z

@yuki24 nice! Have you sent a pull request to enable public_file_server as mentioned in the outdated diffs yet? 😁

yuki24 · 2015-11-03T15:18:38Z

@kaspth Not yet. I'm not sure if I can work on it anytime soon, so feel free to send a PR if you could.

schneems · 2015-11-03T16:04:44Z

What was the idea?

As discussed in rails#19135 (comment). Replaces `serve_static_files` to unify the static options under the `public_file_server` wing. Deprecates `serve_static_files` accessors, but make them use the newer config internally.

kaspth · 2015-11-03T22:13:37Z

@yuki24 @schneems added a pull request at #22173 😁

kaspth · 2015-11-03T22:15:16Z

actionpack/CHANGELOG.md

Feels like this should be in the Railties CHANGELOG file. I will change it at #22173.

It was deprecated in #19135. We're now favoring `public_file_server.headers`.

…ions. Deprecation of static_cache_control: rails/rails#19135 Deprecation of serve_static_files: rails/rails#22173

yuki24 reviewed Feb 28, 2015
View reviewed changes

robin850 added the actionpack label Mar 2, 2015

yuki24 force-pushed the access-control-support branch from ab1bc3f to 68e35a0 Compare March 3, 2015 02:51

schneems reviewed Mar 3, 2015
View reviewed changes

yuki24 force-pushed the access-control-support branch from 68e35a0 to ef5c266 Compare March 4, 2015 13:28

yuki24 reviewed Mar 4, 2015
View reviewed changes

yuki24 force-pushed the access-control-support branch from ef5c266 to 57e68ad Compare May 2, 2015 02:13

yuki24 mentioned this pull request May 15, 2015

Rails api #19832

Merged

yuki24 force-pushed the access-control-support branch from 57e68ad to 582cca3 Compare June 10, 2015 12:02

yuki24 reviewed Jun 10, 2015
View reviewed changes

yuki24 force-pushed the access-control-support branch from 582cca3 to 8914567 Compare June 10, 2015 12:18

vipulnsward reviewed Jun 10, 2015
View reviewed changes

yuki24 mentioned this pull request Jun 11, 2015

Change the index arg of ActionDispatch::Static#new to a kwarg #20520

Merged

yuki24 force-pushed the access-control-support branch 5 times, most recently from f235974 to 3223d80 Compare June 12, 2015 12:24

yuki24 force-pushed the access-control-support branch from 3223d80 to 5226058 Compare June 13, 2015 17:03

jeremy merged commit 5226058 into rails:master Oct 13, 2015

jeremy added a commit that referenced this pull request Oct 13, 2015

Merge pull request #19135 from yuki24/access-control-support

9d05430

Add basic support for access control headers to ActionDispatch::Static

yuki24 deleted the access-control-support branch October 15, 2015 10:51

connorshea mentioned this pull request Oct 19, 2015

Rails 5.0 Tracking Issue noidedmedia/ImageHex#261

Open

4 tasks

kaspth mentioned this pull request Nov 3, 2015

Add enabled flag to the public file server settings. #22173

Merged

kaspth reviewed Nov 3, 2015
View reviewed changes

actionpack/CHANGELOG.md

Copy link

Contributor

kaspth Nov 3, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feels like this should be in the Railties CHANGELOG file. I will change it at #22173.

kaspth added a commit that referenced this pull request Nov 5, 2015

[ci skip] Remove final mentions of static_cache_control in docs.

c453f9c

It was deprecated in #19135. We're now favoring `public_file_server.headers`.

bonjourmauko mentioned this pull request Sep 2, 2016

Assets precompile fails in Rails 5 mattolson/heroku_rails_deflate#23

Open

Add basic support for access control headers to ActionDispatch::Static #19135

Add basic support for access control headers to ActionDispatch::Static #19135

Conversation

yuki24 commented Feb 28, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

schneems commented Mar 2, 2015

Uh oh!

yuki24 commented Mar 3, 2015

Uh oh!

yuki24 commented Mar 3, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

schneems commented May 21, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yuki24 commented Jun 10, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vipulnsward commented Jun 10, 2015

Uh oh!

yuki24 commented Jun 13, 2015

Uh oh!

schneems commented Oct 13, 2015

Uh oh!

jeremy commented Oct 13, 2015

Uh oh!

yuki24 commented Oct 15, 2015

Uh oh!

kaspth commented Nov 3, 2015

Uh oh!

yuki24 commented Nov 3, 2015

Uh oh!

schneems commented Nov 3, 2015

Uh oh!

kaspth commented Nov 3, 2015

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants