{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/9940","labels_url":"https://api.github.com/repos/rails/rails/issues/9940/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/9940/comments","events_url":"https://api.github.com/repos/rails/rails/issues/9940/events","html_url":"https://github.com/rails/rails/issues/9940","id":12469627,"number":9940,"title":"Multiple accept headers' specificity is misinterpreted","user":{"login":"ekampp","id":40206,"avatar_url":"https://avatars.githubusercontent.com/u/40206?v=3","gravatar_id":"","url":"https://api.github.com/users/ekampp","html_url":"https://github.com/ekampp","followers_url":"https://api.github.com/users/ekampp/followers","following_url":"https://api.github.com/users/ekampp/following{/other_user}","gists_url":"https://api.github.com/users/ekampp/gists{/gist_id}","starred_url":"https://api.github.com/users/ekampp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekampp/subscriptions","organizations_url":"https://api.github.com/users/ekampp/orgs","repos_url":"https://api.github.com/users/ekampp/repos","events_url":"https://api.github.com/users/ekampp/events{/privacy}","received_events_url":"https://api.github.com/users/ekampp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rails/rails/labels/actionpack","name":"actionpack","color":"FFF700"},{"url":"https://api.github.com/repos/rails/rails/labels/stale","name":"stale","color":"444444"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":61,"created_at":"2013-03-26T20:29:27Z","updated_at":"2015-07-31T02:07:00Z","closed_at":null,"body":"The HTTP standard clearly states that higher specificity mime-types should take precedence, when multiple mimetypes is supplied. This is not the case with the current version of rails (cloned of master branch).\r\n\r\n    curl http://localhost:3000/entries --header \"Accept:application/json, text/plain\"\r\n\r\nshould return json, and in fact does so. While\r\n\r\n    curl http://localhost:3000/entries --header \"Accept:application/json, text/plain, */*\"\r\n\r\nshould still return json, since the `*/*` is less specific, but this returns html.\r\n\r\nHere is [a test application](https://github.com/ekampp/accept-header-specificity-test) where this can be tested."},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/126542316","html_url":"https://github.com/rails/rails/issues/9940#issuecomment-126542316","issue_url":"https://api.github.com/repos/rails/rails/issues/9940","id":126542316,"user":{"login":"demsullivan","id":3767534,"avatar_url":"https://avatars.githubusercontent.com/u/3767534?v=3","gravatar_id":"","url":"https://api.github.com/users/demsullivan","html_url":"https://github.com/demsullivan","followers_url":"https://api.github.com/users/demsullivan/followers","following_url":"https://api.github.com/users/demsullivan/following{/other_user}","gists_url":"https://api.github.com/users/demsullivan/gists{/gist_id}","starred_url":"https://api.github.com/users/demsullivan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demsullivan/subscriptions","organizations_url":"https://api.github.com/users/demsullivan/orgs","repos_url":"https://api.github.com/users/demsullivan/repos","events_url":"https://api.github.com/users/demsullivan/events{/privacy}","received_events_url":"https://api.github.com/users/demsullivan/received_events","type":"User","site_admin":false},"created_at":"2015-07-31T02:07:00Z","updated_at":"2015-07-31T02:07:00Z","body":"I'm not seeing this issue happen in Rails 4.2.1 - even with `Accept: application/json, text/javascript, */*` Rails will respond with JSON.\r\n\r\nHowever, when using CORS, it breaks.\r\n\r\nStarting from a plain Rails project, I have the following in my `ApplicationController`:\r\n```\r\n  before_filter :cors_preflight_check\r\n  after_filter :cors_set_access_control_headers\r\n\r\n  def cors_set_access_control_headers\r\n    headers['Access-Control-Allow-Origin'] = '*'\r\n    headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, DELETE, OPTIONS'\r\n    headers['Access-Control-Allow-Headers'] = 'Origin, Content-Type, Accept, Authorization, Token'\r\n    headers['Access-Control-Max-Age'] = \"1728000\"\r\n  end\r\n\r\n  def cors_preflight_check\r\n    if request.method == 'OPTIONS'\r\n      headers['Access-Control-Allow-Origin'] = '*'\r\n      headers['Access-Control-Allow-Methods'] = 'POST, GET, PUT, DELETE, OPTIONS'\r\n      headers['Access-Control-Allow-Headers'] = 'X-Requested-With, X-Prototype-Version, Token'\r\n      headers['Access-Control-Max-Age'] = '1728000'\r\n\r\n      render :text => '', :content_type => 'text/plain'\r\n    end\r\n  end\r\n```\r\n\r\nAnd in my `ProductsController`:\r\n\r\n```\r\nclass ProductsController < ApplicationController\r\n  def index\r\n    respond_to do |format|\r\n      format.html\r\n      format.json { render json: {msg: \"it worked\"} }\r\n    end\r\n  end\r\nend\r\n```\r\n\r\nIssuing `$.ajax('/products')` from `http://localhost:3000/` sends `Accept: */*` and Rails responds with HTML.\r\n\r\nIssuing `$.ajax({url: 'products', dataType: 'json'})` from `http://localhost:3000/` sends `Accept: application/json, text/javascript, */*` and Rails responds with JSON.\r\n\r\nThat's fine.\r\n\r\nNow from any other domain:\r\n\r\nIssuing `$.ajax('http://localhost:3000/products')` from any other domain sends `Accept: */*` and Rails responds with HTML.\r\n\r\nIssuing `$.ajax({url: 'http://localhost:3000/products', dataType: 'json'})` from any other domain sends `Accept: application/json, text/javascript, */*` and Rails responds with **HTML** when it should respond with **JSON**.\r\n\r\n"}}