title: CORS issue using Grape API and Heroku
body: <p>I have a read-only API and it works well locally with a Vagrant setup. Live on my Heroku app, every API request is denied due to a CORS error: "No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access."</p>
  
  <p>In my API's base class, I have the following to set the headers:</p>
  
  <pre><code>module API
    class Base &lt; Grape::API
      before do
        headers['Access-Control-Allow-Origin'] = '*'
        headers['Access-Control-Allow-Methods'] = 'GET, OPTIONS'
        headers['Access-Control-Request-Method'] = '*'
        headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
      end
  
      mount API::V1::Base   
    end
  end
  </code></pre>
  
  <p>I suspect that this <code>before</code> call is not being fired—if I use a puts statement inside of it, that statement does not appear in my console with the rest of the output.</p>
  
  <p>I am at a loss. Hopefully someone has some experience with this. Thank you.</p>
  
  <p><strong>Edit:</strong> I have also followed <a href="https://github.com/intridea/grape#cors" rel="noreferrer">Grape's CORS instructions</a> but get the same result.</p>
  
  <p><strong>Success.</strong> I used the <a href="https://github.com/cyu/rack-cors" rel="noreferrer">rack-cors</a> gem and the following:</p>
  
  <pre><code>#application.rb
  config.middleware.use Rack::Cors do
    allow do
      origins '*'
  
      # location of your API
      resource '/api/*', :headers =&gt; :any, :methods =&gt; [:get, :post, :options, :put]
    end
  end
  </code></pre>