Cors过滤器-允许所有子域

Question

// populating the header required for CORS
response.addHeader(
           "Access-Control-Allow-Origin",
           "https://*.myDomain.com");

response.addHeader(
           "Access-Control-Allow-Origin",
           "*.myDomain.com");

Answer 1

我也有类似的问题，答案是肯定的。

下面是我的解决方案（基于origin头处理access-control-allog-Origin）

1.从“Origin”标头解析主机

    // origin
    String origin = request.getHeader("Origin");

    URL originUrl = null;
    try {
        originUrl = new URL(origin);
    } catch (MalformedURLException ex) {
    }

    // originUrl.getHost() -> Return the host need to be verified

    // Allow myDomain.com
    // Or anySubDomain.myDomain.com
    // Or subSub.anySubDomain.myDomain.com

    // hostAllowedPattern 
    Pattern hostAllowedPattern = Pattern.compile("(.+\\.)*myDomain\\.com", Pattern.CASE_INSENSITIVE);

    // Allow host?
    if (hostAllowedPattern.matcher(originUrl.getHost()).matches()) {
        response.addHeader("Access-Control-Allow-Origin", origin);

    } else {
        // Throw 403 status OR send default allow
        response.addHeader("Access-Control-Allow-Origin", "https://my_domain.com");
    }

    // If 'origin': https://sub1.myDomain.com  --> Matched
    Access-Control-Allow-Origin: https://sub1.myDomain.com

    // If 'origin': https://sub2.myDomain.com   --> Matched
    Access-Control-Allow-Origin: https://sub2.myDomain.com

    // If 'origin': https://notAllowDomain.com   --> Not Matched
    Access-Control-Allow-Origin: https://my_domain.com

    You need to verify scheme & port too.