Might be worth mentioning in the README that middleware order in Rails apps matters.

[cyu]

Might be worth mentioning in the README that middleware order in Rails apps matters.

[mgodwin]

+1

This fixed an issue I was getting where any 4xx or 5xx errors were being 'cancelled' by Chrome with a message of

... Origin http://localhost is not allowed by Access-Control-Allow-Origin.

Was able to fix by doing the following:

config.middleware.insert 0, Rack::Cors do
  # Config
end

[adamniedzielski]

+1

I've run into this issue while integrating rack-cors with devise. Devise was responding with 401 Unauthorized before rack-cors could set the headers. I've resolved this with:

config.middleware.insert_before Warden::Manager, Rack::Cors do
  # rest
end

[marcelobfonseca]

How can i position Rack::Cors in the stack middleware for a Non rails application?