rkh/rack-protection — Issue #14: Rack::Protection and CORS
Author: jamiehodge
Created: 2012-01-15 22:28:46+00:00
State: open

Is set :protection, except: :json_csrf the only option?

My headers look like this (in development):

headers \
'Access-Control-Allow-Origin' => 'http://localhost:9294',
'Access-Control-Allow-Methods' => %w{GET POST PUT DELETE OPTIONS}.join(','),
'Access-Control-Allow-Headers' => %w{Origin Accept Content-Type X-Requested-With X-CSRF-Token}.join(',')