An idea for a Rails CORS policy DSL implementation.

cors_policy.rb

# Configuration DSL, probably in config/initializers/cors.rb
CORS::Policy.configure do
  policy :polleverywhere do
    origins   'pollev.com', 'www.polleverywhere.com'
    # I think allowable request method can be inferred by Rails routing.
    # methods   :get, :put, :post, :delete, :patch
    headers   'X-Custom-Request-Header'
    expose    'X-Custom-Response-Header'
  end

  policy :development do
    origins 'localhost:*', '127.0.0.1:*'
  end
  
  # If the proc returns a truthy value, then let this request through.
  policy :partners do
    origins Proc.new{ |origin| Partners.find_by_origin(origin) }
  end

  policy :all do
    origins '*'
  end
end

# Blanket policy
class ApplicationController < ActionController::Base
  cors :polleverywhere, :development # This is the default policy for all controllers.
end

# Controller DSL
class PollsController < ApplicationController
  cors :all, :only => %w[show index]
  cors :polleverywhere, :development, :only => %w[edit update destroy]
  cors :partners, :only => %w[edit update]
  
  # ...
end