Cross Origin Resource Sharing with Sinatra
It’s no lie that I think highly of the potential of Cross Origin Resource Sharing. One of the great things about it is that it doesn’t take much re-wiring of existing server (or client-side) apps to start working cross domain.
Enabling your server app is as simple as including a few extra headers when you detect a cross origin request. How do you know it’s a cross origin request? You’ll see the Origin: header — all CORS requests will have it. From there, response headers depend on the specifics of the request, but I won’t go over those here — check out the Mozilla Developer Center treatment for in-depth information.
I’ve been working with Sinatra a lot lately, so I put together an extension for Sinatra that makes enabling Cross Origin requests even easier.
sudo gem install sinatra-cross_origin
There are two ways to use the extension: globally or per-route.
Global
For when you want to share all your endpoints cross-domain.
require 'sinatra/base'
require 'sinatra/cross_origin'
class MyApp < Sinatra::Base
register Sinatra::CrossOrigin
enable cross_origin
get '/' do
"This is available to cross domain javascript requests automatically"
end
end
Per Route
For when you want to share only some of your routes cross-domain.
require 'sinatra/base'
require 'sinatra/cross_origin'
class MyApp < Sinatra::Base
register Sinatra::CrossOrigin
get '/' do
cross_origin
"This is available to cross domain javascript requests"
end
end
Configuration
You can mix and match app-wide config and request specific config.
require 'sinatra/base'
require 'sinatra/cross_origin'
class MyApp < Sinatra::Base
register Sinatra::CrossOrigin
configure do
# Comma separate list of remote hosts that are allowed.
# :any will allow any host
set :allow_origin, :any
# HTTP methods allowed
set :allow_methods, [:get, :post]
# Allow cookies to be sent with the requests
set :allow_credentials, true
end
get '/' do
# Only available to GET requests originating from
# http://example.com. No cookies allowed.
cross_origin :allow_origin => 'http://example.com',
:allow_methods => [:get],
:allow_credentials => false
"This is available to cross domain javascripts"
end
end
Grab the source at Github: britg/sinatra-cross_origin.
wshields are discussing. 
escort services 9:19 am on March 1, 2011 Permalink
Cross-origin resource sharing Sending messages is not the only solution for sharing information between different websites. The cross-origin resource sharing API loosens the controls over AJAX calls to anywhere but the home domain. …
Chris Castle 4:52 am on July 4, 2011 Permalink
Hey Brit- Thanks for putting this together. I’m trying to make an HTTPS cross-domain request with Basic Auth. I’m using Sinatra (obviously) on the server and jquery on the client. I’m getting a 401 Unauthorized response from the server. In looking at the Request headers I don’t see the browser sending the ‘Authorization’ header. Here are the request and response headers. Any idea what’s wrong? If I hit the Request URL by itself in a browser, the auth box pops up, I enter my credentials, and everything works great — but not when it’s requested via javascript…
Request URL:https://my.site.com/ec2/describe?env=dev&instanceId=i-b285d4dfRequest Method:GETStatus Code:401 UnauthorizedRequest HeadersAccept:*/*Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3Accept-Encoding:gzip,deflate,sdchAccept-Language:en-US,en;q=0.8Connection:keep-aliveHost:my.site.comOrigin:http://localhost:4567Referer:http://localhost:4567/index.htmlUser-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.41 Safari/535.1Query String Parametersenv:devinstanceId:i-b285d4dfResponse HeadersAccess-Control-Allow-Credentials:trueAccess-Control-Allow-Headers:AuthorizationAccess-Control-Allow-Methods:GET, POST, UPDATE, DELETE, OPTIONS, HEADAccess-Control-Allow-Origin:http://localhost:4567Access-Control-Max-Age:1728000Connection:keep-aliveContent-Length:15Content-Type:text/html;charset=utf-8Server:thin 1.2.11 codename Bat-Shit CrazyWWW-Authenticate:Basic realm=”Restricted Area”