Rails, REST Architecture and HTML 5: Cross domain requests with pre-flight requests

Question

While working on a project to make our site HTML 5 friendly, we were eager to embrace the new method for Cross Domain requests (no more posting through hidden iframes!!!). Using the Access Control specification we begin setting up some tests to verify the behaviour of various browsers.

The current Rails RESTful architecture relies on the four HTTP verbs: GET, POST, PUT, DELETE. However in the Access Control spec, it dictates that non-simple methods (PUT, DELETE) require a pre-flight request using the HTTP verb OPTIONS. In addition during testing we discovered that Firefox 3.5.8 pre-flight POST requests as well.

My question is this. Is anyone aware of any project for the Rails framework working to address the issue? If not, any opinions about the best strategy to support the OPTIONS method, since it has to support the routes for all the POST, PUT, DELETE methods?

Answer 1

I released a Gem a couple of days ago that implements CORS support via a Rack Middleware:

http://github.com/cyu/rack-cors

Regarding preflight CORS requests, I couldn't get preflight requests working in Chrome (through simple CORS requests work fine). Searching around the Internets suggests that it might not be supported. I've asked questions in the Chrome forum about this, but haven't heard a response yet.

Answer 2

I hacked rails to support the options method. I posted this on the rails list, but it never made it past the list.

GitHub Gist: Rails XHR2 / CORS / OPTIONS support

ctrl+f to find the lines that have #Options - those are the only ones I changed.

And here's an example implementation | and another