Allow Cross-origin resource sharing for GitLab API

It will allow to write web applications on other domains to interact
with GitLab instances

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Gemfile

@@ -44,6 +44,7 @@ gem "gitlab-linguist", "~> 2.9.6", require: "linguist"
 # API
 gem "grape", "~> 0.4.1"
 gem "grape-entity", "~> 0.3.0"
+gem 'rack-cors', require: 'rack/cors'
 
 # Format dates and times
 # based on human-friendly examples

Gemfile.lock

@@ -335,6 +335,7 @@ GEM
       rack
     rack-cache (1.2)
       rack (>= 0.4)
+    rack-cors (0.2.9)
     rack-mini-profiler (0.1.31)
       rack (>= 1.1.3)
     rack-mount (0.8.3)
@@ -610,6 +611,7 @@ DEPENDENCIES
   pry
   quiet_assets (~> 1.0.1)
   rack-attack
+  rack-cors
   rack-mini-profiler
   rails (= 3.2.16)
   rails-dev-tweaks

config/application.rb

@@ -79,5 +79,13 @@ module Gitlab
     # config.relative_url_root = "/gitlab"
 
     config.middleware.use Rack::Attack
+
+    # Allow access to GitLab API from other domains
+    config.middleware.use Rack::Cors do
+      allow do
+        origins '*'
+        resource '/api/*', headers: :any, methods: [:get, :post, :options, :put]
+      end
+    end
   end
 end