Forget rack-cors and just set config.action_controller.forgery_protec…

…tion_origin_check = false
mlibrary · Sep 23, 2024 · 7a1bc20 · 7a1bc20
1 parent 436321b
commit 7a1bc20
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/Gemfile b/Gemfile
@@ -21,8 +21,6 @@ gem "aws-sdk-s3", "~> 1.160"
 gem "content_disposition", "~> 1.0"
 gem "uppy-s3_multipart", "~> 1.2"
 
-# CORS
-gem 'rack-cors'
 
 #####################################
 # Try to work around brokenness on

diff --git a/config/application.rb b/config/application.rb
@@ -23,6 +23,10 @@
 module Dromedary
   class Application < Rails::Application
 
+    # CORS with rails running not-at-the-root turns out to be mostly broken.
+    # So we do this, which stinks.
+    config.action_controller.forgery_protection_origin_check = false
+
     config.time_zone = 'Eastern Time (US & Canada)'
 
     # Initialize configuration defaults for originally generated Rails version.