Add module for allowing requests from Labs domain

app/controllers/application_controller.rb

 class ApplicationController < ActionController::Base
   include Authentication
+  include AddProxyRequestOrigin
 
   def send_file
     File.open("tmp/#{params[:filename]}", "r") do |f|

config/environments/development.rb

@@ -76,6 +76,4 @@ Rails.application.configure do
   # Allow Action Cable access from any origin.
   config.action_cable.url = ENV['NEP_CABLE_URL'] || 'http://127.0.0.1:3000/cable'
   config.action_cable.allowed_request_origins = [ENV['NEP_LABS_DOMAIN'], 'http://127.0.0.1:8001']
-  # Allow XHR/Ajax requests from different origin
-  config.action_controller.forgery_protection_origin_check = false
 end

config/initializers/cors.rb

+# Allow requests from Labs domain
+module AddProxyRequestOrigin
+  extend ActionController::RequestForgeryProtection
+
+  allowed_request_origins = [ENV['NEP_LABS_DOMAIN'], 'http://127.0.0.1:8001']
+
+  def valid_request_origin? # :doc:
+    if forgery_protection_origin_check
+      # We accept blank origin headers because some user agents don't send it.
+      raise InvalidAuthenticityToken, NULL_ORIGIN_MESSAGE if request.origin == "null"
+      request.origin.nil? || request.origin == request.base_url || request.origin in allowed_request_origins
+    else
+      true
+    end
+  end
+end