intridea/grape — pull request #518 by simonask (2013-11-27 14:33:22+00:00)
Title: Pass on Access-Control-Allow-Origin headers in Grape::Endpoint#error!.

`error!` current throws away any headers set by the app. This is a problem when a browser is communicating with the API using standard AJAX REST, because some browsers (notably all WebKit browsers) will ignore the response body unless Access-Control-Allow-Origin is properly set, regardless of what was reported by an earlier OPTIONS request to the same path. This prevents clients from reacting appropriately to certain errors, such as 401 Unauthorized or 400 Bad Request (for instance when a POSTed resource fails to validate on the server, and the client wishes to prompt the user for corrections).

This does not happen in Firefox, which seems to actually use the result of the OPTIONS when no Access-Control-Allow-Origin header is set.

This patch extends the `error!` method to 1) accept a hash of headers that can be passed when raising the error, and 2) automatically pass along any Access-Control-Allow-Origin.

I'm unsure if it really belongs in `Grape::Middleware::Error`, but this seems to do the trick. :-)