How do I specify Origin Whitelist Options in Sinatra using Rack/Protection

Question

I have a web app, lets say http://web.example.com making a POST request to http://api.example.com. The api server is running the latest version of Sinatra with rack protect

Answer 1

Pass your options as a hash to set :protection:

set :protection, :origin_whitelist => ['http://web.example.com']

Sinatra will then pass them through to Rack::Protection when setting it up.

I suspect the reason it is failing when you have use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://web.example.com'] is that you still have protection enabled, so that you end up with two instances of HttpOrigin. You could try

set :protection, :except => [:http_origin]
use Rack::Protection::HttpOrigin, :origin_whitelist => ['http://web.example.com']

(i.e. have both the lines you’ve tried together), but I think the first solution is cleaner.