rack-cors fails fine uploader preflight - ruby-on-rails

Question

I'm trying to use fine uploader from my react frontend, to upload to my rails 5 backend.
rack-cors is second in my middlewares list:
use Webpacker::DevServerProxy
use Rack::Cors
use Rack::Sendfile
use ActionDispatch::Static
use ActionDispatch::Executor
use ActiveSupport::Cache::Strategy::LocalCache::Middleware
use Rack::Runtime
use ActionDispatch::RequestId
use ActionDispatch::RemoteIp
use Rails::Rack::Logger
use ActionDispatch::ShowExceptions
use WebConsole::Middleware
use ActionDispatch::DebugExceptions
use ActionDispatch::Reloader
use ActionDispatch::Callbacks
use ActiveRecord::Migration::CheckPending
use Rack::Head
use Rack::ConditionalGet
use Rack::ETag
use Warden::Manager
run Project::Application.routes
When fine uploader tries to upload an image, I get in the console:
Failed to load http://localhost:5000/item/1374/image: Response to preflight
request doesn't pass access control check: No 'Access-Control-Allow-Origin'
header is present on the requested resource. Origin 'http://lvh.me:3000' is
therefore not allowed access.
I can see the preflight (options) http request, with the following data:
GENERAL
Request URL:http://localhost:5000/item/1374/image
Request Method:OPTIONS
Status Code:200 OK
Remote Address:127.0.0.1:5000
Referrer Policy:no-referrer-when-downgrade
RESPONSE HEADERS:
HTTP/1.1 200 OK
Content-Type: text/plain
Transfer-Encoding: chunked
REQUEST HEADERS:
OPTIONS /item/1374/image HTTP/1.1
Host: localhost:5000
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Access-Control-Request-Method: update
Origin: http://lvh.me:3000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36
Access-Control-Request-Headers: cache-control,x-requested-with
Accept: */*
DNT: 1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,it;q=0.8
this is the cors debug log of the same call:
{"Access-Control-Allow-Origin"=>"http://lvh.me:3000", "Access-Control-Allow-Methods"=>"GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD", "Access-Control-Expose-Headers"=>"access-token, expiry, token-type, uid, client, Access-Control-Allow-Origin", "Access-Control-Max-Age"=>"1728000", "Access-Control-Allow-Credentials"=>"true"}
Incoming Headers:
Origin: http://lvh.me:3000
Access-Control-Request-Method: update
Access-Control-Request-Headers: cache-control,x-requested-with
Preflight Headers:
Content-Type: text/plain
my config/initializers/cors.rb looks like:
Rails.application.config.middleware.insert_before 0, Rack::Cors, debug: true, logger: (-> { Rails.logger }) do
allow do
origins 'localhost:3000',
'http://localhost:3000',
'127.0.0.1:3000',
/\Ahttp:\/\/192\.168\.0\.\d{1,3}(:\d+)?\z/,
'http://lvh.me:3000'
resource '*',
headers: :any,
expose: %w[access-token expiry token-type uid client Access-Control-Allow-Origin],
credentials: true,
methods: %i[get post put patch delete options head]
end
end
I also tried with origin '*' and credentials: false, but got the same result.
I don't understand where the problem could be..

Answer 1

my fault, I was requesting an update, but was allowing only put and patch.
I changed the request to a put, and now I'm one step closer to walhalla.