xmlhttprequest - Sinatra/Thin: CSRF Warning on CORS xhr preflight request -

i've written server handle cross site json requests. it's api meant called ajax. got working, still getting strange warnings.

since of api calls posts, there preflight options request triggers warning (thin output):

127.0.0.1 - - [15/aug/2013 22:24:20] "options /login http/1.1" 200 - 0.0080 w, [2013-08-15t22:24:20.124254 #3236]  warn -- : attack prevented rack::prote ction::httporigin 

here's preflight header request causes this:

options /login http/1.1 host: localhost:3000 connection: keep-alive access-control-request-method: post origin: http://localhost:4567 user-agent: mozilla/5.0 (windows nt 6.1; wow64) applewebkit/537.36 (khtml, gecko) chrome/28.0.1500.95 safari/537.36 access-control-request-headers: origin, content-type accept: */* referer: http://localhost:4567/index.html accept-encoding: gzip,deflate,sdch accept-language: en-us,en;q=0.8 

additionally, i'd know warning:

security warning: no secret option provided rack::session::cookie. poses security threat. recommended provide secret prevent exploits may possible crafted cookies. not supported in future versions of rack, , future versions invalidate existing user cookies. 

here's server code headers should allowing cors xhr:

enable :sessions  before    headers['access-control-allow-origin'] = 'http://localhost:4567'   headers['access-control-allow-headers'] = 'origin, content-type, accept'   headers['access-control-allow-credentials'] = 'true'    if request.request_method == 'options'     headers["access-control-allow-methods"] = "post, get"     halt 200   end end 

this 2 related questions, i'll address them 1 @ time.

1. according this question looks need provide origin whitelist sinatra. trying protect cross site scripting attacks harm users. however, there cases when want allow cross site scripting occur. can this:

   set :protection, :origin_whitelist => ['http://web.example.com'] 

   the headers apply user's browser, rack needs permission well. 2 lines of defense. more information, see documentation rack::protection (which sinatra uses here).

2. the "secret option" error refers setting on rack::session. when use rack::session functionality can pass in secret this:

   use rack::session::cookie, :key => 'rack.session',                            :domain => 'foo.com',                            :path => '/',                            :expire_after => 2592000,                            :secret => 'change_me' 

   do above instead of simple enable :sessions. can find documentation rack::session here.