Cors Filter - Allow all sub domains

Question

I would like my CorsFilter to do the following:

// populating the header required for CORS
response.addHeader(
           "Access-Control-Allow-Origin",
           "https://*.myDomain.com");

The whole idea is to allow the following domains to make a request: sub1.myDomain.com, sub2.myDomain.com, sub3.myDomain.com .... sub100.myDomain.com

This didn't work for me. How can I achieve this? Iv'e tried:

response.addHeader(
           "Access-Control-Allow-Origin",
           "*.myDomain.com");

as well with no success.

Answer 1

This use case is now directly supported by CorsConfiguration.setAllowedOriginPatterns.

Modifying the docs example to match your question, this could be:

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOriginPatterns(Arrays.asList("https://*.myDomain.com"));
        configuration.setAllowedMethods(Arrays.asList("GET","POST"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

It's worth noting that wildcards like this are still not part of the CORS standard. Instead, this is a Spring mechansim for returning CORS-compliant header values based on your pattern.

E.g. if you now make a call from Origin=https://subdomain.myDomain.com the response will contain the header Access-Control-Allow-Origin=https://subdomain.myDomain.com.

Answer 2

I am having the similar question and the answer is Yes.

Here is my solution ( Handling Access-Control-Allow-Origin based on the origin header)

1. Parse host from the 'origin' header

    // origin
    String origin = request.getHeader("Origin");

    URL originUrl = null;
    try {
        originUrl = new URL(origin);
    } catch (MalformedURLException ex) {
    }

    // originUrl.getHost() -> Return the host need to be verified

2. Check originUrl.getHost()

    // Allow myDomain.com
    // Or anySubDomain.myDomain.com
    // Or subSub.anySubDomain.myDomain.com

    // hostAllowedPattern 
    Pattern hostAllowedPattern = Pattern.compile("(.+\\.)*myDomain\\.com", Pattern.CASE_INSENSITIVE);

    // Allow host?
    if (hostAllowedPattern.matcher(originUrl.getHost()).matches()) {
        response.addHeader("Access-Control-Allow-Origin", origin);

    } else {
        // Throw 403 status OR send default allow
        response.addHeader("Access-Control-Allow-Origin", "https://my_domain.com");
    }

3. Result:

    // If 'origin': https://sub1.myDomain.com  --> Matched
    Access-Control-Allow-Origin: https://sub1.myDomain.com

    // If 'origin': https://sub2.myDomain.com   --> Matched
    Access-Control-Allow-Origin: https://sub2.myDomain.com

    // If 'origin': https://notAllowDomain.com   --> Not Matched
    Access-Control-Allow-Origin: https://my_domain.com

4. Others:

    You need to verify scheme & port too.

Answer 3

You can't, it's either full domain, null or all: *.

Like spec says: http://www.w3.org/TR/cors/#access-control-allow-origin-response-header