DOC: using this middleware for assets on heroku

With Rails4 (maybe others too), heroku precompile the assets but, so… the middleware ActionDispatch::Static catch the request and respond very soon.

To define CORS for assets, don’t use config.middleware.use Rack::Cors, instead use config.middleware.insert_before ActionDispatch::Static, Rack::Cors to ensure thar CORS are applied before responding as static.

A typical scenario is “fonts” served as assets from heroku (not S3 synched), with cloudfront (or not) in the middle, requested from firefox (cors required).

I think is only necessary to update the documentation with this particular case, to avoid a lot of tears and pain to other developers.

[toobulkeh]

Thanks Cyu, you rock! So I added this code to nginx: http://davidwalsh.name/cdn-fonts

  location ~* \.(eot|ttf|woff)$ {
    add_header Access-Control-Allow-Origin *;
  }

Which works when I query the Asset using CURL:

root@staging:/u/apps/test/current# curl -I https://staging.test.com/assets/fonts/snapy.woff
HTTP/1.1 200 OK
Server: nginx/1.2.6
Date: Thu, 25 Sep 2014 18:38:49 GMT
Content-Type: application/octet-stream
Content-Length: 11632
Last-Modified: Thu, 25 Sep 2014 17:49:34 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

It was still failing, but I had to let the nginx cache-out for it to work again from a different domain.

Thanks!

[amba178]

this is the setting for my cors, and still does not work when deploying to heroku, any suggestions

config.middleware.insert_before ActionDispatch::Static, Rack::Cors, :debug => true, :logger => (-> { Rails.logger }) do allow do origins ‘’ resource ‘/cors’, :headers => :any, :methods => [:post], :credentials => true, :max_age => 0 resource '’, :headers => :any, :methods => [:get, :post, :delete, :put, :patch, :options, :head], :max_age => 0 end end