prepareRequest(req, res, next) {
    req.isAPI = true;
    if (!['GET', 'HEAD', 'OPTIONS'].includes(req.method) &&
      req.get('x-requested-with') != 'XMLHttpRequest' &&
      req.get('x-requested-with') != 'app') {
      let response = {};
      response.message = 'Access denied.';
      response.errors = ['Missing X-Requested-With header. Must be set to "XMLHttpRequest" or "app" to avoid request forgery.'];
      res.status(400);
      res.type('json');
      res.send(JSON.stringify(response, null, 2));
    } else {
      // Allow external access to all read methods
      if (['GET', 'HEAD', 'OPTIONS'].includes(req.method))
        res.set('Access-Control-Allow-Origin', '*');

      return next();
    }
  }
// from a browser or an application.
from a browser or an application.
from a browser or an application .
prepareRequest(req, res, next) {
    req.isAPI = true;
    if (!['GET', 'HEAD', 'OPTIONS'].includes(req.method) &&
      req.get('x-requested-with') != 'XMLHttpRequest' &&
      req.get('x-requested-with') != 'app') {
      let response = {};
      response.message = 'Access denied.';
      response.errors = ['Missing X-Requested-With header. Must be set to "XMLHttpRequest" or "app" to avoid request forgery.'];
      res.status(400);
      res.type('json');
      res.send(JSON.stringify(response, null, 2));
    } else {
      if (['GET', 'HEAD', 'OPTIONS'].includes(req.method))
        res.set('Access-Control-Allow-Origin', '*');
      return next();
    }
  }
prepareRequest ( req , res , next ) { req . isAPI = true ; if ( ! [ 'GET' , 'HEAD' , 'OPTIONS' ] . includes ( req . method ) && req . get ( 'x-requested-with' ) != 'XMLHttpRequest' && req . get ( 'x-requested-with' ) != 'app' ) { let response = { } ; response . message = 'Access denied.' ; response . errors = [ 'Missing X-Requested-With header. Must be set to "XMLHttpRequest" or "app" to avoid request forgery.' ] ; res . status ( 400 ) ; res . type ( 'json' ) ; res . send ( JSON . stringify ( response , null , 2 ) ) ; } else { if ( [ 'GET' , 'HEAD' , 'OPTIONS' ] . includes ( req . method ) ) res . set ( 'Access-Control-Allow-Origin' , '*' ) ; return next ( ) ; } }
from a browser or an application.
from a browser or an application .
// Allow external access to all read methods