Comments (5)
[Rewrote issue title for clarity]
I have a workaround for this, which I got from @padrino (https://github.com/padrino/padrino-framework/wiki/Cross-domain-requests,-Access-Control-Allow-Origin) and @cyu (https://github.com/cyu/rack-cors)
After cloning the phnatom repo, I edited the Gemfile to add this line:
gem 'rack-cors'
And edited config.ru to add this:
use Rack::Cors do allow do origins '*' resource '/retrieve-form-elements', :headers => :any, :methods => [:post, :options] end end
And now the preflight check from Chrome works and I can actually do the post.
Obviously you need to edit origins for your real allowed origins, and add the other apis as allowed resources. And a good solution would get the origins from the CORS_ALLOWED_DOMAINS variable.
I would be happy to put together a PR to really fix, if I could get a volunteer to guide me a bit, as I don't know a thing about Rails/Ruby/etc.
from phantom-of-the-capitol.
@PollyP CORS_ALLOWED_DOMAINS
should actually be an array, and its values can be given in the environment variable CORS_ALLOWED_DOMAINS
as a space separated list.
You can include *
in the list as well to allow all origins. See main.rb#L9-L15:
before do
if CORS_ALLOWED_DOMAINS.include? request.env['HTTP_ORIGIN'] or CORS_ALLOWED_DOMAINS.include? "*"
response.headers['Access-Control-Allow-Origin'] = request.env['HTTP_ORIGIN']
response.headers['Access-Control-Allow-Credentials'] = "true"
end
response.headers['X-Backend-Hostname'] = Socket.gethostname
end
from phantom-of-the-capitol.
@wioux I stuck a log warning in there to track down the problem, and this code was never getting called. The server filtered out the http options method before it ever hit this code.
from phantom-of-the-capitol.
Ah! Ok, thanks for pointing that out. It seems appropriate to include the rack-cors gem as you suggest.
It looks like you can pattern match all resources with *
, instead of having to specify /retrieve-form-elements
. That would be useful since this issue should crop up with many of our routes (e.g. those under the debug/cwc controllers as well).
I would put the configuration in phantom-dc_config.rb.example. There, you may have to call Padrino.use
instead of the global function.
from phantom-of-the-capitol.
Hi, My PR is failing the Travis build here: https://travis-ci.org/EFForg/phantom-of-the-capitol/builds/196075289. It is not liking the addition to the Gemfile. Is there something special I need to do to make Travis happy?
UPDATE: Ah, yes, the Gemfile.lock needs to be committed. The Travis build works now.
@wioux Thanks for your advice above.
from phantom-of-the-capitol.
Related Issues (20)
- More detailed error message from /fill-out-form endpoint? HOT 1
- Can't Connect to MySQL Using Docker HOT 5
- Aborted connection '#' to db: ... Got an error reading communication packets HOT 2
- ReCaptcha support HOT 3
- sending html within $MESSAGE HOT 1
- Add dnt-policy to /.well-known
- If "verify email" is a field, API required fields returns two fields called "$EMAIL". Impossible to reply with two $EMAIL key values. HOT 5
- phantomjs alternative HOT 20
- add this project to ios mobile project HOT 8
- rename docker-compose.test.yml to something else
- How to pass $CAPTCHA_SOLUTION parameter value to fill-out-form method?
- Issue with fill-out-form for contact pages with reCAPTCHA HOT 2
- related to bundle
- How are you solving reCAPTCHA? HOT 1
- 502 bad gateway on congressforms.eff.org
- Rake file version error
- Getting bad gateway HOT 2
- Issue while trying to run the following command phantom-dc docker HOT 9
- Support test posts to /fill-out-form HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from phantom-of-the-capitol.