Class: RrxApi::Engine

Inherits:

Rails::Engine

• Object
• Rails::Engine
• RrxApi::Engine

Defined in:

lib/rrx_api/engine.rb

Constant Summary

CORS_LOCALHOST_PATTERN =

/\Ahttp:\/\/localhost(?::\d{4})?\z/.freeze

Class Method Summary

• .cors_origin_allowed?(source, origins) ⇒ Boolean

  Checks whether source matches any of the configured CORS origins.

Class Method Details

.cors_origin_allowed?(source, origins) ⇒ Boolean

Checks whether source matches any of the configured CORS origins. Each entry in cors_origins may be:

• a String for exact match (e.g. "https://app.example.com")
• a String with a leading wildcard (e.g. "*.example.com" matches "https://foo.example.com")
• a Regexp (e.g. /.example.com\z/)

Returns:

• (Boolean)

# File 'lib/rrx_api/engine.rb', line 24

def self.cors_origin_allowed?(source, origins)
  origins.any? do |origin|
    case origin
    when Regexp then origin.match?(source)
    when String
      if origin.start_with?('*.')
        # Wildcard subdomain: *.example.com matches any scheme+subdomain of example.com
        suffix = origin[1..]  # => ".example.com"
        source.end_with?(suffix)
      else
        source == origin
      end
    end
  end
end