ruby 10 lines · 1 tab

Security focused CORS configuration for browser APIs

Kai Nakamura Apr 2026

1 tab

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins 'https://app.example.com', 'https://admin.example.com'
    resource '/api/*',
      headers: %w[Authorization Content-Type],
      methods: %i[get post patch delete options],
      credentials: true,
      max_age: 600
  end
end

1 file · ruby Explain with highlit

CORS is not an authentication control, but bad CORS settings still widen attack surface unnecessarily. I allow exact origins, restrict methods and headers, and avoid wildcard credentials combinations entirely. If the front-end origin list is unclear, that is a design problem to solve, not a reason to use *.

Related snips

ruby

event_id = request.headers.fetch('X-Event-Id')
timestamp = request.headers.fetch('X-Signature-Timestamp').to_i

raise ActionController::BadRequest, 'stale request' if Time.now.to_i - timestamp > 300
raise ActionController::BadRequest, 'replay detected' if WebhookEvent.exists?(external_id: event_id)

Secure webhook endpoint design with replay protection

webhooks replay-protection hmac

by Kai Nakamura 1 tab

ruby

Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins_list = if Rails.env.production?
                     ENV['CORS_ALLOWED_ORIGINS']&.split(',') || []
                   else
                     'localhost:3000', 'localhost:5173', /127\.0\.0\.1:\d+/

CORS configuration for cross-origin API requests

rails api security

by Alex Kumar 1 tab

ruby

Rails.application.config.session_store(
  :cookie_store,
  key: '_codesnips_session',
  secure: Rails.env.production?,
  httponly: true,
  same_site: :lax,

Session cookie hardening for browser based authentication

sessions cookies authentication

by Kai Nakamura 1 tab

ruby

class CspReportsController < ActionController::API
  def create
    Rails.logger.warn({
      event: 'csp_report',
      report: params.to_unsafe_h,
      ip: request.remote_ip,

CSP report endpoint for monitoring attempted browser policy violations

csp reporting browser-security

by Kai Nakamura 1 tab

python

INSTALLED_APPS += ['corsheaders']

MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',  # Must be before CommonMiddleware
    'django.middleware.common.CommonMiddleware',
    # ... other middleware

Django CORS configuration for API access

django python cors

by Priya Sharma 1 tab

typescript

const rawOrigins = process.env.ALLOWED_ORIGINS ?? "";

export const allowedOrigins = new Set(
  rawOrigins
    .split(",")
    .map((o) => o.trim())

CORS configuration that’s explicit (no *)

security http express

by codesnips 3 tabs

Share this code

Here's the card — post it anywhere.

Security focused CORS configuration for browser APIs — share card

Link copied