javascript - Setting up cross-domain calls on Rails server - Stack Overflow

admin管理员组

文章数量:1395785

I'm developing a Rails API, and a separate html5 application. They do not share the same domain. How do I set up my Rails application to accept cross-domain requests? I have added the following to the top of my ApplicationController, but without any luck -

  before_filter :set_access_control_headers

  def set_access_control_headers
    headers['Access-Control-Allow-Origin'] = ':3002'
    headers['Access-Control-Request-Method'] = 'GET, OPTIONS, HEAD'
    headers['Access-Control-Allow-Headers'] = 'x-requested-with,Content-Type, Authorization'
  end

My javascript on my other app looks as follows -

var req = $.ajax({
  url: url,
  type: "GET",
  crossDomain: true,

  success: function(data, textStatus, jqXHR)
  {
     alert('success');
  },
  error: function(jqXHR, textStatus, errorThrown)
  {
     alert('error');
  }
});

When I run this request, I get the following in my server log -

Started OPTIONS "/api/search?location_uuid=22222222222222222" for 127.0.0.1 at 2013-07-15 16:49:56 -0400
Processing by Api::V1::SearchController#index as JSON
  Parameters: {"location_uuid"=>"22222222222222222"}
WARNING: Can't verify CSRF token authenticity
  User Load (20.5ms)  SELECT "users".* FROM "users" ORDER BY name DESC LIMIT 30 OFFSET 0
(63.1ms)  SELECT COUNT(*) FROM "users" 
Completed 204 No Content in 300ms (ActiveRecord: 0.0ms)

Anyone have any tips in getting this to work correctly?

I'm developing a Rails API, and a separate html5 application. They do not share the same domain. How do I set up my Rails application to accept cross-domain requests? I have added the following to the top of my ApplicationController, but without any luck -

  before_filter :set_access_control_headers

  def set_access_control_headers
    headers['Access-Control-Allow-Origin'] = 'http://myfrontend.:3002'
    headers['Access-Control-Request-Method'] = 'GET, OPTIONS, HEAD'
    headers['Access-Control-Allow-Headers'] = 'x-requested-with,Content-Type, Authorization'
  end

My javascript on my other app looks as follows -

var req = $.ajax({
  url: url,
  type: "GET",
  crossDomain: true,

  success: function(data, textStatus, jqXHR)
  {
     alert('success');
  },
  error: function(jqXHR, textStatus, errorThrown)
  {
     alert('error');
  }
});

When I run this request, I get the following in my server log -

Started OPTIONS "/api/search?location_uuid=22222222222222222" for 127.0.0.1 at 2013-07-15 16:49:56 -0400
Processing by Api::V1::SearchController#index as JSON
  Parameters: {"location_uuid"=>"22222222222222222"}
WARNING: Can't verify CSRF token authenticity
  User Load (20.5ms)  SELECT "users".* FROM "users" ORDER BY name DESC LIMIT 30 OFFSET 0
(63.1ms)  SELECT COUNT(*) FROM "users" 
Completed 204 No Content in 300ms (ActiveRecord: 0.0ms)

Anyone have any tips in getting this to work correctly?

• javascript
• jquery
• ruby-on-rails
• cross-domain

Share Improve this question Follow asked Jul 15, 2013 at 21:18 BlakeBlake 2,39733 gold badges2525 silver badges3535 bronze badges 3

• Stupid but - do you have implemented action for OPTIONS? How does you route for this look like? – Mike Szyndel Commented Jul 15, 2013 at 21:28
• 1 Try after_filter instead of before_filter. – mccannf Commented Jul 15, 2013 at 21:53
• That's an interesting observation. In my request I specify GET, but the log indicates the OPTIONS header is being set. The route looks like this - namespace :api, defaults: {format: 'json'} do scope module: :v1 do match "/search", :to => "search#index" end end – Blake Commented Jul 15, 2013 at 21:54

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 4

It seems that adding the data-type as JSONP avoids the cross browser problems:

var req = $.ajax({
  url: url,
  type: "GET",
  crossDomain: true,
  dataType: "JSONP",
  ...

See this question for more info -

Can anyone explain what JSONP is, in layman terms?

本文标签： javascriptSetting up crossdomain calls on Rails serverStack Overflow