{"action":"opened","issue":{"url":"https://api.github.com/repos/sahat/satellizer/issues/351","labels_url":"https://api.github.com/repos/sahat/satellizer/issues/351/labels{/name}","comments_url":"https://api.github.com/repos/sahat/satellizer/issues/351/comments","events_url":"https://api.github.com/repos/sahat/satellizer/issues/351/events","html_url":"https://github.com/sahat/satellizer/issues/351","id":68203915,"number":351,"title":"Rails + Angular CORS","user":{"login":"luseerr","id":4478274,"avatar_url":"https://avatars.githubusercontent.com/u/4478274?v=3","gravatar_id":"","url":"https://api.github.com/users/luseerr","html_url":"https://github.com/luseerr","followers_url":"https://api.github.com/users/luseerr/followers","following_url":"https://api.github.com/users/luseerr/following{/other_user}","gists_url":"https://api.github.com/users/luseerr/gists{/gist_id}","starred_url":"https://api.github.com/users/luseerr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luseerr/subscriptions","organizations_url":"https://api.github.com/users/luseerr/orgs","repos_url":"https://api.github.com/users/luseerr/repos","events_url":"https://api.github.com/users/luseerr/events{/privacy}","received_events_url":"https://api.github.com/users/luseerr/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-13T21:58:26Z","updated_at":"2015-04-13T21:58:26Z","closed_at":null,"body":"Hello. I've been trying to implement Satellizer (which is an awesome tool by the way) into my angular app and it was (almost) sucessful, but I have a weird problem with CORS which I can't figure out. When I run my in chrome with --disable-web-secrutiy I can register/authenticate without any problems, but when I try to run it without that option things get messy.\r\n\r\nSo what I do is- click on button which runs $auth.authenticate in my controller, facebook/google (I only use these two) popup appears, I fill in my data, accept everything, popup disappears and in console I get an error which says \"XMLHttpRequest cannot load http://127.0.0.1:3000/auth/google_oauth2. The request was redirected to 'https://accounts.google.com/o/oauth2/auth?access_type=offline&client_id=142…scope=email+profile&state=1651b2916b69913f87b6dfb325a6eda72954fed6619e99d3', which is disallowed for cross-origin requests that require preflight.\"\r\n\r\nI will try to post as many informations as I can, because I've spent many hours trying to fix it myself, but it looks like I am missing something. So, my frontend config file looks like that:\r\n```coffeescript\r\n.config ($httpProvider, $authProvider,  jwtInterceptorProvider, RestangularProvider, ENV) ->\r\n  RestangularProvider.setBaseUrl(ENV.API_URL)\r\n  RestangularProvider.setRequestSuffix('.json')\r\n  $httpProvider.defaults.useXDomain = true;\r\n\r\n  delete $httpProvider.defaults.headers.common['X-Requested-With'];\r\n\r\n  $httpProvider.defaults.headers.patch['Content-Type'] = 'application/json'\r\n  $httpProvider.defaults.headers.common['X-CSRF-Token'] = $('meta[name=csrf-token]').attr('content')\r\n\r\n  jwtInterceptorProvider.tokenGetter = (store) ->\r\n    return store.get('jwt')\r\n\r\n  $httpProvider.interceptors.push('jwtInterceptor')\r\n\r\n  $authProvider.google\r\n    clientId: \"myclientid\"\r\n    url: \"http://127.0.0.1:3000/auth/google_oauth2\"\r\n    redirectUri: \"http://127.0.0.1:4400\"\r\n```\r\ngoogle configuration: \r\n![zrzut ekranu 2015-04-13 23 46 37](https://cloud.githubusercontent.com/assets/4478274/7126168/6463885a-e237-11e4-9751-456842f92ca6.png)\r\n\r\nAnd I run this using ng-click pointing to controller's action, which looks like that:\r\n```coffeescript\r\n  $scope.authenticate = (provider) ->\r\n    $auth.authenticate(provider).then (response) ->\r\n      store.set('jwt', response.data.token)\r\n      store.set('currentUserId', response.data.user_id)\r\n      if AuthServ.isAuthenticated()\r\n        $state.go ('root.main')\r\n```\r\nRuby on Rails part: In routes I've got\r\n```ruby\r\nmatch '/auth/:provider/callback', to: 'api/v1/oauth#create', via: 'get'\r\n```\r\nwhich points to my create action looking like that:\r\n\r\n```ruby\r\nmodule Api\r\n  module V1\r\n    class OauthController < ApplicationController\r\n      require 'auth_token'\r\n\r\n      def create\r\n        binding.pry\r\n        auth_hash = request.env['omniauth.auth']\r\n        auth = Authorization.find_or_create(auth_hash)\r\n        @token = AuthToken.issue_token(user_id: auth.user.id)\r\n        render json: { token: @token, user_id: auth.user.id }, status: 200\r\n      end\r\n    end\r\n  end\r\nend\r\n```\r\nAnd going further, my Authorization model looks like this:\r\n\r\n```ruby\r\nclass Authorization < ActiveRecord::Base\r\n  validates :provider, presence: true\r\n  validates :uid, presence: true\r\n\r\n  belongs_to :user\r\n\r\n  def self.find_or_create(auth_hash)\r\n    auth = find_by_provider_and_uid(auth_hash['provider'], auth_hash['uid'])\r\n    unless auth\r\n      user = User.create(first_name: auth_hash['info']['name'], password: Digest::SHA2.hexdigest(Time.now.to_s), email: auth_hash['info']['email'])\r\n      auth = create(user: user, provider: auth_hash['provider'], uid: auth_hash['uid'])\r\n    end\r\n    auth\r\n  end\r\nend\r\n```\r\nI have tried adding CORS in rails using rack::cors, but it didn't change anything, this is how it looks like:\r\n```ruby\r\nmodule MyappBackend\r\n  class Application < Rails::Application\r\n    config.active_record.raise_in_transactional_callbacks = true\r\n\r\n    # Allow cross-domain requests\r\n    config.middleware.insert_before 0, \"Rack::Cors\", :debug => true, :logger => (-> { Rails.logger }) do\r\n      allow do\r\n        origins '*'\r\n        resource '*', headers: :any, methods: [:get, :post, :put, :patch, :delete, :options],\r\n        max_age: 0\r\n      end\r\n    end\r\n  end\r\nend\r\n```\r\nI've tried to apply anything I could find in google, but without any luck.\r\nThe thing is- with --disable-web-security everything works smooth, but when I try to run chrome/safari/firefox in normal mode, I always get that darn CORS error.\r\n\r\nI have tried to debug satellizer.js and found out that in line 487:\r\n```javascript\r\nreturn $http.post(defaults.url, data, { withCredentials: config.withCredentials });\r\n```\r\nI always get to an error, with data, status and header looking like this:\r\n![zrzut ekranu 2015-04-13 23 57 28](https://cloud.githubusercontent.com/assets/4478274/7126353/d6f7c010-e238-11e4-8c43-7cd6d2df571a.png)\r\n\r\nAny ideas how to get it working? I am out of ideas. Please provide me any informations that might be useful and keep it up with your awesome project.\r\nRegards.\r\n"}}