cors.rb

allow do
    origins '*'
    resource(
      '*',
      max_age: 1728000,
      credentials: false,
      methods: [
        :get, :post, :delete, :put, :patch, :options, :head],
      headers: [
        "Accept",
        "Accept-Expansion",
        "Accept-Inclusion",
        "Authorization",
        "Cache-Control",
        "Content-Type",
        "Heroku-Deploy-Source",
        "Heroku-Deploy-Type",
        "Heroku-Password",
        "Heroku-Two-Factor-Code",
        "If-Modified-Since",
        "If-None-Match",
        "Range",
        "Request-Id",
        "X-Confirmation-Required",
        "X-Heroku-Legacy-Ids",
        "X-Heroku-Requester",
        "X-Origin",
        "X-Range",
        "X-Request-Id"],
      expose: [
        "Cache-Control",
        "Content-Language",
        "Content-Type",
        "Expires",
        "Last-Modified",
        "Next-Range",
        "Pragma",
        "X-Heroku-Maintenance"]
    )
end