module APISample class Application < Rails::Application ... config.middleware.insert_before ActionDispatch::Static, Rack::Cors do allow do origins '*' resource '*', :headers => :any, :methods => [:get, :post, :options, :patch, :delete] end end ... end end