title: Sending an Angular post request with parameter to Rails API
body: <p>I´m not able to completely integrate an Angular front-end with a Rails back-end API. They both run in differente servers, so I think I have problems with CORS.</p>
  
  <p>My Angular app is running a controller that is calling a service that has resource with a query (GET) and save (POST) methods. The query (GET) is working fine, however the post is not working.</p>
  
  <p>I´m able to send a POST request to the server when I don´t send any parameter. Like this:</p>
  
  <p>Controller:</p>
  
  <pre><code>$scope.createBusiness = function() {
  
          console.log("Business.name=" + $scope.business.name);           
          $scope.business = Business.save(); 
      };
  </code></pre>
  
  <p>Service:</p>
  
  <pre><code> .factory('Business', 
  
    function($resource){          
      var businesses =
       $resource('http://127.0.0.1\\:3000/:business', {business:'businesses'}, {      
          query: {method:'GET', isArray: true},
          save: {method:'POST', isArray: false}
       });        
       return businesses;           
    }
  </code></pre>
  
  <p>);</p>
  
  <p>However, I want to post my model parameters, so when I try to send something then I don´t send a POST request anymore, but an OPTIONS request. And I get an error.</p>
  
  <p>Please, see my request data when I send a request <strong>without</strong> parameters (POST request):</p>
  
  <pre><code>Request URL:http://127.0.0.1:3000/businesses
  Request Method:POST
  Status Code:200 OK
  Request Headersview source
  Accept:application/json, text/plain, */*
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:es-ES,es;q=0.8
  Connection:keep-alive
  Content-Length:0
  Content-Type:text/plain;charset=UTF-8
  Host:127.0.0.1:3000
  Origin:http://localhost:1234
  Referer:http://localhost:1234/app/index.html
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36
  Response Headersview source
  Access-Control-Allow-Headers:Origin, X-Requested-With, Content-Type, Accept, Authorization
  Access-Control-Allow-Methods:POST, PUT, DELETE, GET, OPTIONS
  Access-Control-Allow-Origin:*
  Access-Control-Max-Age:1728000
  Access-Control-Request-Method:*
  Cache-Control:max-age=0, private, must-revalidate
  Connection:Keep-Alive
  Content-Length:9
  Content-Type:application/json; charset=utf-8
  Date:Mon, 04 Nov 2013 16:50:33 GMT
  Etag:"ccd3d779b6f97e2c24633184cbc8f98c"
  Server:WEBrick/1.3.1 (Ruby/2.0.0/2013-06-27)
  X-Content-Type-Options:nosniff
  X-Frame-Options:SAMEORIGIN
  X-Request-Id:e084295e-c7c6-4566-80d1-6e2a8ac2e712
  X-Runtime:0.034000
  X-Ua-Compatible:chrome=1
  X-Xss-Protection:1; mode=block
  </code></pre>
  
  <p>I reach the server, execute the method and get the response! This is ok. </p>
  
  <p>and, see my request data when I send a request <strong>WITH</strong> parameters (OPTIONS request):</p>
  
  <pre><code>Request URL:http://127.0.0.1:3000/businesses
  Request Method:OPTIONS
  Status Code:404 Not Found
  Request Headersview source
  Accept:*/*
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:es-ES,es;q=0.8
  Access-Control-Request-Headers:accept, content-type
  Access-Control-Request-Method:POST
  Connection:keep-alive
  Host:127.0.0.1:3000
  Origin:http://localhost:1234
  Referer:http://localhost:1234/app/index.html
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36
  Response Headersview source
  Connection:Keep-Alive
  Content-Length:131852
  Content-Type:text/html; charset=utf-8
  Date:Mon, 04 Nov 2013 16:54:04 GMT
  Server:WEBrick/1.3.1 (Ruby/2.0.0/2013-06-27)
  X-Request-Id:25705159-fbfb-4830-a0f1-6610fa09b70e
  X-Runtime:0.371000
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I forgot to add my controller when adding a model parameter:</p>
  
  <pre><code>$scope.createBusiness = function() {
  
          console.log("Business.name=" + $scope.business.name);           
          $scope.business = Business.save($scope.business); 
      };
  </code></pre>
  
  <p>I have several views, with several forms, so, I don´t want only to post a form, but the business object model that I have in scope (and I filled with the data of all the forms).</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>This is my Rails Application_Controller (CORS configuration):</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
  
  
   # Prevent CSRF attacks by raising an exception.
    # For APIs, you may want to use :null_session instead.
    # OJOJOOJO: Rober: I have commented this line which is provided by default with rails and added all code below in order to 
    # add CSRF protection 
    #protect_from_forgery with: :exception
  
    protect_from_forgery
  
    before_filter :cors_preflight_check
    after_filter :cors_set_access_control_headers, :set_csrf_cookie_for_ng
  
  # For all responses in this controller, return the CORS access control headers.
  
    def cors_set_access_control_headers
      headers['Access-Control-Allow-Origin'] = '*'
      headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS'
      headers['Access-Control-Request-Method'] = '*'
      headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
      headers['Access-Control-Max-Age'] = "1728000"
    end
  
  # If this is a preflight OPTIONS request, then short-circuit the
  # request, return only the necessary headers and return an empty
  # text/plain.
  
    def cors_preflight_check
      if request.method == :options
        headers['Access-Control-Allow-Origin'] = '*'
        headers['Access-Control-Allow-Methods'] = 'POST, PUT, DELETE, GET, OPTIONS'
        headers['Access-Control-Request-Method'] = '*'
        headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Authorization'
        headers['Access-Control-Max-Age'] = '1728000'
        render :text =&gt; '', :content_type =&gt; 'text/plain'
      end
    end
  
    def set_csrf_cookie_for_ng
      cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
    end
  
  protected
  
    def verified_request?
      super || form_authenticity_token == request.headers['X_XSRF_TOKEN']
    end  
  end
  </code></pre>