CORs Rails integration

application_controller.rb

class ApplicationController < ActionController::Base
  protect_from_forgery  

  before_filter :cor

private
  def cor
    headers["Access-Control-Allow-Origin"]  = "js-app-origin.com"
    headers["Access-Control-Allow-Methods"] = %w{GET POST PUT DELETE}.join(",")
    headers["Access-Control-Allow-Headers"] = %w{Origin Accept Content-Type X-Requested-With X-CSRF-Token}.join(",")
    head(:ok) if request.request_method == "OPTIONS"
  end
end

routes.rb

YourApp::Application.routes.draw do
  ...

  match '*all' => 'application#cor', :constraints => {:method => 'OPTIONS'}
end