如何在Sails.js API上正确配置CORS

Question

My app is consisting from angularjs on frontend and sailsjs on backend. I am trying to configure CORS on my backend, but without success. I want that backend on address api.example.com is accessible only from frontend from address blog.example.com. My settings on sails config/cors.js are:

allRoutes: false,
origin: 'http://blog.example.com',
credentials: true,
methods: 'GET, POST, PUT, DELETE, OPTIONS, HEAD',
headers: 'content-type'

Result is, that my backend is freely accessible if I type to browser address bar api.example.com, but NOT from my frontend! In Chrome I get answer: "The 'Access-Control-Allow-Origin' header contains the invalid value ' '", Firefox sends just empty Response Body. I tried to configure cors in config/routes.js too, but also no success. Any help is appreciated!

Answer 1

You want allRoutes: true unless your enabling cors on a route by route basis.

http://sailsjs.org/documentation/concepts/security/cors