gistfile1.rb

class AssetOriginInjectionMiddleware
 def initialize(app)
    @app = app
  end

  def call(env)
    # this is a weird hack. what it does is 
    # add the production origin access allowed origin header
    # of the production sites url
    # if we happen to be serving an asset.
    # when we serve assets, cloud front should pick this header up, and re-serve
    # it to us, where finally our clients can consume it and believe its been authorized
    modify_it = false
    if (Rails.env == "production") && (env['PATH_INFO']) && (env['PATH_INFO'].to_s[0..6] == "/assets")
      modify_it = true
    end
    @status, @headers, @response = @app.call(env)
    if modify_it
      @headers["Access-Control-Allow-Origin"] = "http://my_production_domain.com"
    end
    [@status, @headers, @response]
  end
end