Signed-off-by: Adrian Hinz <ahinz@voicetelecom.pl>

app/controllers/application_controller.rb

@@ -3,11 +3,19 @@ class ApplicationController < ActionController::Base
   before_action :authenticate_user!
   before_action :set_locale
   layout :layout_by_resource
+  after_filter :set_headers
 
   def set_locale
     I18n.locale = params[:lang] || I18n.default_locale
   end
 
+  def set_headers
+    headers['Access-Control-Allow-Origin'] = 'lvh.me'
+    headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS'
+    headers['Access-Control-Request-Method'] = '*'
+    headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
+  end
+
   protected
 
   def layout_by_resource

config/application.rb

@@ -13,7 +13,7 @@ module InvoiceKeeper
     # -- all .rb files in that directory are automatically loaded.
     config.i18n.load_path += Dir[Rails.root.join('config', 'locales', '**', '*.{rb,yml}').to_s]
     config.i18n.default_locale = :pl
-    config.action_dispatch.default_headers['X-Frame-Options'] = "ALLOW-FROM http://lvh.me"
+    config.action_dispatch.default_headers['X-Frame-Options'] = "ALLOW-FROM lvh.me"
     config.assets.paths << Rails.root.join('app', 'assets', 'fonts')
     config.assets.precompile += %w( .svg .eot .woff .ttf .otf .woff2 )
   end