Replace setting custom CORS headers with rack-cors, set it on /oauth/token endpoint
parent
b13e7dda1f
commit
448ab18a20
2
Gemfile
2
Gemfile
|
@ -4,7 +4,6 @@ gem 'rails', '5.0.0.1'
|
|||
gem 'sass-rails', '~> 5.0'
|
||||
gem 'uglifier', '>= 1.3.0'
|
||||
gem 'coffee-rails', '~> 4.1.0'
|
||||
gem 'therubyracer', platforms: :ruby
|
||||
gem 'jquery-rails'
|
||||
gem 'jbuilder', '~> 2.0'
|
||||
gem 'sdoc', '~> 0.4.0', group: :doc
|
||||
|
@ -39,6 +38,7 @@ gem 'htmlentities'
|
|||
gem 'simple_form'
|
||||
gem 'will_paginate'
|
||||
gem 'rack-attack'
|
||||
gem 'rack-cors', require: 'rack/cors'
|
||||
gem 'sidekiq'
|
||||
gem 'ledermann-rails-settings'
|
||||
gem 'neography'
|
||||
|
|
|
@ -157,7 +157,6 @@ GEM
|
|||
activerecord (>= 3.1)
|
||||
letter_opener (1.4.1)
|
||||
launchy (~> 2.2)
|
||||
libv8 (3.16.14.15)
|
||||
link_header (0.0.8)
|
||||
lograge (0.4.1)
|
||||
actionpack (>= 4, < 5.1)
|
||||
|
@ -219,6 +218,7 @@ GEM
|
|||
rack (2.0.1)
|
||||
rack-attack (5.0.1)
|
||||
rack
|
||||
rack-cors (0.4.0)
|
||||
rack-protection (1.5.3)
|
||||
rack
|
||||
rack-test (0.6.3)
|
||||
|
@ -281,7 +281,6 @@ GEM
|
|||
redis-store (~> 1.2.0)
|
||||
redis-store (1.2.0)
|
||||
redis (>= 2.2)
|
||||
ref (2.0.0)
|
||||
responders (2.3.0)
|
||||
railties (>= 4.2.0, < 5.1)
|
||||
rspec (3.5.0)
|
||||
|
@ -349,9 +348,6 @@ GEM
|
|||
activesupport (>= 4.0)
|
||||
sprockets (>= 3.0.0)
|
||||
temple (0.7.7)
|
||||
therubyracer (0.12.2)
|
||||
libv8 (~> 3.16.14.0)
|
||||
ref
|
||||
thor (0.19.1)
|
||||
thread_safe (0.3.5)
|
||||
tilt (2.0.5)
|
||||
|
@ -419,6 +415,7 @@ DEPENDENCIES
|
|||
puma
|
||||
rabl
|
||||
rack-attack
|
||||
rack-cors
|
||||
rails (= 5.0.0.1)
|
||||
rails_12factor
|
||||
rails_autolink
|
||||
|
@ -433,7 +430,6 @@ DEPENDENCIES
|
|||
sidekiq
|
||||
simple_form
|
||||
simplecov
|
||||
therubyracer
|
||||
uglifier (>= 1.3.0)
|
||||
webmock
|
||||
will_paginate
|
||||
|
|
|
@ -7,7 +7,6 @@ class ApiController < ApplicationController
|
|||
skip_before_action :verify_authenticity_token
|
||||
|
||||
before_action :set_rate_limit_headers
|
||||
before_action :set_cors_headers
|
||||
|
||||
rescue_from ActiveRecord::RecordInvalid do |e|
|
||||
render json: { error: e.to_s }, status: 422
|
||||
|
@ -50,13 +49,6 @@ class ApiController < ApplicationController
|
|||
response.headers['X-RateLimit-Reset'] = (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
|
||||
end
|
||||
|
||||
def set_cors_headers
|
||||
response.headers['Access-Control-Allow-Origin'] = '*'
|
||||
response.headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS'
|
||||
response.headers['Access-Control-Request-Method'] = '*'
|
||||
response.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
|
||||
end
|
||||
|
||||
def set_pagination_headers(next_path = nil, prev_path = nil)
|
||||
links = []
|
||||
links << [next_path, [['rel', 'next']]] if next_path
|
||||
|
|
|
@ -27,6 +27,15 @@ module Mastodon
|
|||
|
||||
config.active_job.queue_adapter = :sidekiq
|
||||
|
||||
config.middleware.insert_before 0, Rack::Cors do
|
||||
allow do
|
||||
origins '*'
|
||||
|
||||
resource '/api/*', :headers => :any, :methods => [:post, :put, :delete, :get, :options], credentials: false
|
||||
resource '/oauth/token', :headers => :any, :methods => [:post], credentials: false
|
||||
end
|
||||
end
|
||||
|
||||
config.middleware.use Rack::Attack
|
||||
config.middleware.use Rack::Deflater
|
||||
|
||||
|
@ -38,9 +47,9 @@ module Mastodon
|
|||
end
|
||||
|
||||
config.action_dispatch.default_headers = {
|
||||
'X-Frame-Options' => 'DENY',
|
||||
'X-Frame-Options' => 'DENY',
|
||||
'X-Content-Type-Options' => 'nosniff',
|
||||
'X-XSS-Protection' => '1; mode=block'
|
||||
'X-XSS-Protection' => '1; mode=block'
|
||||
}
|
||||
end
|
||||
end
|
||||
|
|
Reference in New Issue