access_control.rb

module Rack
  class AccessControl

    def initialize(app, options = {})
      @app = app
      @options = options

      @options[:allow_origin] ||= "http://example.com"
      @options[:allow_methods] ||= "GET, POST, PUT, DELETE"
      @options[:allow_credentials] ||= "true"
      @options[:allow_headers] ||= "x-requested-with"
      @options[:max_age] ||= "3628800"
    end

    def access_control_headers
      {
        "Access-Control-Allow-Origin" => @options[:allow_origin],
        "Access-Control-Allow-Methods" => @options[:allow_methods],
        "Access-Control-Allow-Credentials" => @options[:allow_credentials],
        "Access-Control-Allow-Headers" => @options[:allow_headers],
        "Access-Control-Max-Age" => @options[:max_age]
      }
    end

    def call(env)
      # intercept the "preflight" request
      if env["REQUEST_METHOD"] == "OPTIONS"
        return [200, access_control_headers, []]
      else
        code, headers, body = @app.call(env)
        headers.merge!(access_control_headers)
        [code, headers, body]
      end
    end

  end
end