CORS configuration in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important in web applications?

CORS stands for Cross-Origin Resource Sharing. It is important because it controls how resources on a web server can be requested from another domain, helping to keep web applications secure by preventing unauthorized cross-origin requests.

beginner

In Rails, where do you typically configure CORS settings?

In Rails, CORS settings are usually configured in the file config/initializers/cors.rb using the rack-cors gem.

intermediate

What is the purpose of the 'origins' option in a Rails CORS configuration?

The 'origins' option specifies which domains are allowed to make cross-origin requests to your Rails server. You can set it to '*' to allow all domains or list specific domains for tighter security.

intermediate

Explain what the 'resource' block does in the Rails CORS configuration.

The 'resource' block defines which paths on the server accept cross-origin requests and what HTTP methods and headers are allowed for those requests.

intermediate

Why should you avoid setting 'origins' to '*' in production environments?

Setting 'origins' to '*' allows any website to access your API, which can lead to security risks like data leaks or unauthorized actions. It's safer to specify only trusted domains in production.

Where is the CORS configuration typically placed in a Rails app?

A config/routes.rb

B app/controllers/application_controller.rb

C app/views/layouts/application.html.erb

D config/initializers/cors.rb

CORS settings are usually configured in config/initializers/cors.rb using the rack-cors gem.

What does setting 'origins' to '*' do in CORS configuration?

A Allows only localhost to access resources

B Blocks all cross-origin requests

C Allows all domains to access resources

D Enables HTTPS only

Setting 'origins' to '*' means any domain can make cross-origin requests to your server.

Which HTTP methods can you specify in the 'resource' block for CORS?

A GET, POST, PUT, DELETE, OPTIONS

B CONNECT, TRACE, PATCH only

C HEAD only

D None, methods are not configurable

You can specify common HTTP methods like GET, POST, PUT, DELETE, OPTIONS in the 'resource' block.

Why is CORS configuration important for APIs?

A It manages user authentication

B It controls which external sites can access your API

C It styles the API responses

D It speeds up database queries

CORS controls which external domains can access your API, protecting it from unauthorized cross-origin requests.

What gem is commonly used in Rails to handle CORS?

A rack-cors

B devise

C puma

D sidekiq

The rack-cors gem is commonly used in Rails apps to configure and handle CORS.

Describe how to set up CORS in a Rails application using rack-cors.

Think about the gem, the initializer file, and the configuration block.

Explain why careful CORS configuration is important for web app security.

Consider what could happen if any website could access your server.