Ruby on Rails CORS Preflight Check

application_controller.rb

before_action :cors_set_access_control_headers

def cors_preflight_check
  return unless request.method == 'OPTIONS'
  cors_set_access_control_headers
  render json: {}
end

protected

def cors_set_access_control_headers
  response.headers['Access-Control-Allow-Origin'] = '*'
  response.headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, PATCH, DELETE, OPTIONS'
  response.headers['Access-Control-Allow-Headers'] = 'Origin, Content-Type, Accept, Authorization, Token, ' \
    'Auth-Token, Email, X-User-Token, X-User-Email, x-xsrf-token'
  response.headers['Access-Control-Max-Age'] = '1728000'
  response.headers['Access-Control-Allow-Credentials'] = true
end

routes.rb

match '*all', controller: 'application', action: 'cors_preflight_check', via: [:options]

To anyone still relying on this and the Medium post, the "correct" way to render the response is now head :no_content (notice there is no render).