api_authentication.feature

  Scenario Outline: Make an API request from a different domain
    When I ask if a <http-method> request to <api-path> from a different domain is supported
    Then I should receive a successful response
      And the <http-method> request should be allowed

    Scenarios: Available APIs
      | http-method | api-path                  |
      | GET         | /api/v1/samples           |
      | GET         | /api/v1/samples/1         |
      | PUT         | /api/v1/samples/1         |

api_authentication_steps.rb

When /^I ask if a (.+) request to (.+) from a different domain is supported$/ do |http_method, api_path|
  header 'Accept', 'application/json'
  header 'Content-Type', 'application/json'
  header 'Origin', 'http://example.com'
  header 'Access-Control-Request-Method', http_method
  header 'Access-Control-Request-Headers', 'Origin, Content-Type, Accept'
  options api_path
end

Then /^I should receive a successful response$/ do
  last_response.status.should == 200
end

Then /^the (.+) request should be allowed$/ do |http_method|
  last_response.headers['Access-Control-Allow-Origin'].should == '*'
  last_response.headers['Access-Control-Allow-Methods'].should include(http_method)
end