So I can't seem to get ```install(CORS){ host("*.<http://somedomain.com|somedomain.com>") }``` to...

# ktor

[Jørund Amsen]

So I can't seem to get

install(CORS){
   host("*.<http://somedomain.com|somedomain.com>")
}

to work, does it not support the *. notation?

[Jørund Amsen]

You are absolutely correct, that was just me typing it 😉

[Jonathan Mew]

cool, removed my now unhelpful comments 🙂

[Jonathan Mew]

Does the server start up okay? Can you inspect the requests that you send in your browser okay?

[Jørund Amsen]

The server starts up, anything in the requests that could be useful?

[Jonathan Mew]

Actually, looking at the code, it doesn't appear to support the *.domain structure. You can give a list of subdomains, but not a wildcarded parent domain.

[Jørund Amsen]

Yeah, I seemed to notice the same looking through the code and the tests for it...

[Jørund Amsen]

I thought this was pretty standard

[Jørund Amsen]

Can you see if the subdomains perhaps support * ?

[Jonathan Mew]

from CORS.kt

private fun corsCheckOrigins(origin: String): Boolean {
        return allowsAnyHost || normalizeOrigin(origin) in hostsNormalized
    }

[Jonathan Mew]

Any subdomains are all normalized and added to the hostsNormalized: HashSet<String> and that needs to actually contain the request origin according to corsCheckOrigins, so doesn't look like it

[Jonathan Mew]

Consistent with the spec - maybe there are good security reasons not to allow wildcards https://tools.ietf.org/html/rfc6454#section-7.1

[Jørund Amsen]

Oh, that's interesting. I feel like I've always used wildcards for subdomains. This is problematic