Brian Norton bnorton

Based on information found here on the chromium blog I found that options requests that render with head :ok are blocked by CORB because the resposne has headers of Content-Type: text/plain and X-Content-Type-Options: nosniff. The text/plain content type is a "trigger" for CORB checking and when Rails sets the contet type options to nosniff for this response CORB cannot inspect the response to see if it is safe.

TL;DR add response.headers.delete('X-Content-Type-Options') in your OPTIONS preflight handler

	#! /usr/bin/env bash
	set -e

	export MONGODB_VERSION=3.4.0

	TAR=mongodb-linux-x86_64-ubuntu1404-$MONGODB_VERSION.tgz
	URL=https://fastdl.mongodb.org/linux/$TAR

	echo "---------------------------------------"
	echo "Removing currently installed MongoDB"


	...
	##
	# Until this commit is merged and released by rack
	#
	gem 'rack', git: 'https://github.com/rack/rack.git', ref: 'c859bbf7b53cb59df1837612a8c330dfb4147392'
	...

	class ApplicationController < ActionController::Base
	...
	# Use when setting 3rd party cookies and make sure to tack .compact on the
	# end to make sure that the :same_site key is not included when the value is missing
	#
	def set_cookie(key, value)
	cookies.encrypted[key] = {
	:value => value.to_s,
	:expires => 1.year, :domain => :all,
	:same_site => SameSite.value(request.headers['User-Agent']),

	<!DOCTYPE html>
	<html lang="en">

	<head>
	<meta name="description" content="Chameleon blank page" />
	<meta charset="utf-8">
	<title>Chameleon blank page</title>
	<meta name="viewport" content="width=device-width, initial-scale=1">
	<meta name="author" content="Chameleon">
	</head>