CORS configuration in Ruby on Rails - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow all origins in CORS configuration.

Ruby on Rails

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins [1]
    resource '*', headers: :any, methods: [:get, :post, :options]
  end
end

Drag options to blanks, or click blank then click option'

A"example.com"

B"localhost"

C"*"

D"https://myapp.com"

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting quotes around the origin string.

Using a specific domain when the task asks for all origins.

Using "*" allows all origins to access the resources.

2fill in blank

medium

Complete the code to allow only 'https://example.com' origin in CORS configuration.

Ruby on Rails

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins [1]
    resource '*', headers: :any, methods: [:get, :post, :options]
  end
end

Drag options to blanks, or click blank then click option'

A"https://example.com"

B"https://myapp.com"

C"http://localhost:3000"

D"*"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wildcard * instead of specific origin.

Omitting the protocol in the origin string.

Setting origins to "https://example.com" restricts access to that domain only.

3fill in blank

hard

Fix the error in the CORS configuration to allow GET and POST methods.

Ruby on Rails

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins "*"
    resource '*', headers: :any, methods: [1]
  end
end

Drag options to blanks, or click blank then click option'

A[:get, :post, :delete]

B[:post, :put]

C[:get]

D[:get, :post]

Attempts:

3 left

💡 Hint

Common Mistakes

Including extra HTTP methods not requested.

Using strings instead of symbols for methods.

The methods array should include only :get and :post to allow those HTTP methods.

4fill in blank

hard

Fill both blanks to allow only 'https://app.com' origin and enable GET, POST, and OPTIONS methods.

Ruby on Rails

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins [1]
    resource '*', headers: :any, methods: [2]
  end
end

Drag options to blanks, or click blank then click option'

A"https://app.com"

B[:get, :post, :options]

C[:get, :post]

D"*"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wildcard * for origins when a specific domain is required.

Omitting :options method.

Set origins to "https://app.com" and methods to [:get, :post, :options] to allow those HTTP methods from that origin.

5fill in blank

hard

Fill all three blanks to allow origins 'https://site1.com' and 'https://site2.com', enable GET and POST methods, and allow any headers.

Ruby on Rails

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins [1]
    resource '*', headers: [2], methods: [3]
  end
end

Drag options to blanks, or click blank then click option'

A"https://site1.com", "https://site2.com"

B:any

C[:get, :post]

D"*"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a single string with spaces instead of comma-separated origins.

Using string '*' for headers instead of symbol :any.

Origins can be a list of strings separated by commas. Headers set to :any allows all headers. Methods array includes :get and :post.