rack-cors 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 509192f6673d85eb0b23b4169f5d392d1e380fdc
-  data.tar.gz: 5b123af66d8580566d8012012f62f90e8f4043d8
+  metadata.gz: 7a4d5e6683440676f486ce61b3c16ff2e7c8f65e
+  data.tar.gz: be95c0c3dce56c965aff4b1cb398f2ad6fb4f6b3
 SHA512:
-  metadata.gz: 274193cd4cc2bca5187e0fd7aacb928558cc5a0bddcd236c56b7791ccc8e7ceaffd53f96bae15992960d614de3bfd1ed12c0fa459ad25b7c5313ec8d166bbe1b
-  data.tar.gz: ba69d913329a58954760c7acd2d0d574ca5620e90b98617c65cfc67136433b9b834c6364a018d01dd231632a44a2c5ee4a398bd5fe1d4c27af44ed50e8c0cfbd
+  metadata.gz: 8ae27dfd82bd822e700c476963118b15e68dee7850aaccb8b43a05670903f9f66217c8cd77dcf425f664581ecadf00eb43c1c1926648d97caf07c6d4a4dd0574
+  data.tar.gz: df278b2f1b3e6f0b01305d601fb58f2d41aef0579232d5ae27564be76483afdfb58b9219708d5a944c7db293025d7bacec4924dc63c06aefed2a7df4ad00e9ec

data/lib/rack/cors.rb

@@ -23,6 +23,10 @@ module Rack
 
     DEFAULT_VARY_HEADERS = ['Origin'].freeze
 
+    # All CORS routes need to accept CORS simple headers at all times
+    # {https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers}
+    CORS_SIMPLE_HEADERS = ['accept', 'accept-language', 'content-language', 'content-type'].freeze
+
     def initialize(app, opts={}, &block)
       @app = app
       @debug_mode = !!opts[:debug]
@@ -134,7 +138,7 @@ module Rack
           @logger_proc = nil
           logger_proc.call
 
-        elsif defined?(Rails) && Rails.logger
+        elsif defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
           Rails.logger
 
         elsif env[RACK_LOGGER]
@@ -155,7 +159,7 @@ module Rack
         resource, error = match_resource(env)
         unless resource
           result.miss(error)
-          return {} 
+          return {}
         end
 
         return resource.process_preflight(env, result)
@@ -407,10 +411,14 @@ module Rack
           end
 
           def allow_headers?(request_headers)
-            return false if headers.nil?
-            headers == :any || begin
-              request_headers = request_headers.split(/,\s*/) if request_headers.kind_of?(String)
-              request_headers.all?{|h| headers.include?(h.downcase)}
+            headers = self.headers || []
+            if headers == :any
+              return true
+            end
+            request_headers = request_headers.split(/,\s*/) if request_headers.kind_of?(String)
+            request_headers.all? do |header|
+              header = header.downcase
+              CORS_SIMPLE_HEADERS.include?(header) || headers.include?(header)
             end
           end
 

data/lib/rack/cors/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Cors
-    VERSION = "1.0.1"
+    VERSION = "1.0.2"
   end
 end

data/test/unit/cors_test.rb

@@ -16,7 +16,7 @@ end
 Rack::Test::Methods.class_eval do
   def_delegator :current_session, :options
 end
-  
+
 module MiniTest::Assertions
   def assert_cors_success(response)
   	assert !response.headers['Access-Control-Allow-Origin'].nil?, "Expected a successful CORS response"
@@ -405,6 +405,54 @@ describe Rack::Cors do
     end
   end
 
+  describe 'with headers set to nil' do
+    let(:app) do
+      Rack::Builder.new do
+        use Rack::Cors do
+          allow do
+            origins '*'
+            resource '/', headers: nil
+          end
+        end
+        map('/') do
+          run ->(env) { [200, {'Content-Type' => 'text/html'}, ['hello']] }
+        end
+      end
+    end
+
+    it 'should succeed with CORS simple headers' do
+      preflight_request('http://localhost:3000', '/', :headers => 'Accept')
+      last_response.must_render_cors_success
+    end
+  end
+
+  describe 'with custom allowed headers' do
+    let(:app) do
+      Rack::Builder.new do
+        use Rack::Cors do
+          allow do
+            origins '*'
+            resource '/', headers: []
+          end
+        end
+        map('/') do
+          run ->(env) { [200, {'Content-Type' => 'text/html'}, ['hello']] }
+        end
+      end
+    end
+
+    it 'should succeed with CORS simple headers' do
+      preflight_request('http://localhost:3000', '/', :headers => 'Accept')
+      last_response.must_render_cors_success
+      preflight_request('http://localhost:3000', '/', :headers => 'Accept-Language')
+      last_response.must_render_cors_success
+      preflight_request('http://localhost:3000', '/', :headers => 'Content-Type')
+      last_response.must_render_cors_success
+      preflight_request('http://localhost:3000', '/', :headers => 'Content-Language')
+      last_response.must_render_cors_success
+    end
+  end
+
   protected
     def cors_request(*args)
       path = args.first.is_a?(String) ? args.first : '/'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-cors
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Calvin Yu
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-18 00:00:00.000000000 Z
+date: 2017-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler