Add cors middleware

Author: venkatesh-sivaraman

fireroad/settings.py

@@ -53,7 +53,8 @@
 ]
 
 MIDDLEWARE_CLASSES = [
-    #'django.middleware.security.SecurityMiddleware',
+    # Cors middleware should only be on local development (not settings_dev or settings_prod)
+    'middleware.cors.CorsMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',

fireroad/settings_dev.py

@@ -33,4 +33,12 @@
     }
 }
 
-
+MIDDLEWARE_CLASSES = [
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    'analytics.request_counter.RequestCounterMiddleware'
+]

fireroad/settings_prod.py

@@ -33,4 +33,12 @@
     }
 }
 
-
+MIDDLEWARE_CLASSES = [
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    'analytics.request_counter.RequestCounterMiddleware'
+]

middleware/__init__.py

@@ -0,0 +1,10 @@
+"""
+Small middleware to allow cross-origin resource sharing. Should only be enabled
+in a local development environment.
+"""
+
+class CorsMiddleware(object):
+    def process_response(self, req, resp):
+        resp["Access-Control-Allow-Origin"] = "*"
+        resp["Access-Control-Allow-Headers"] = "*"
+        return resp