added wildcard subdomains for CORS allowed origins

Signed-off-by: Alejandro M. Ramallo <alejandro.ramallo@leapsight.com>

Author: aramallo

apps/bondy/src/bondy_http_cors.erl

@@ -14,7 +14,9 @@ configuration. Supports three origin modes:
 - `auto` — derives the allowed origin from the request's own
   scheme/host/port
 - `[binary()]` — an explicit allowlist of origins; the request
-  `Origin` header is validated against this list
+  `Origin` header is validated against this list. Entries starting
+  with `*.` are treated as wildcard subdomain patterns (e.g.
+  `*.example.com` matches `https://app.example.com`)
 
 Configuration is read from the Bondy application environment at path
 `[ListenerName, cors]` using the listener ref from the Cowboy request.
@@ -112,7 +114,7 @@ effective_origin(Req, #{allowed_origins := AllowedList}) when is_list(AllowedLis
         undefined ->
             undefined;
         Origin ->
-            case lists:member(Origin, AllowedList) of
+            case origin_allowed(Origin, AllowedList) of
                 true -> Origin;
                 false -> undefined
             end
@@ -135,6 +137,56 @@ derive_origin(Req) ->
     end.
 
 
+%% @private
+origin_allowed(_Origin, []) ->
+    false;
+
+origin_allowed(Origin, [Origin | _]) ->
+    true;
+
+origin_allowed(Origin, [<<"*.", Rest/binary>> | Tail]) ->
+    case origin_matches_wildcard(Origin, Rest) of
+        true -> true;
+        false -> origin_allowed(Origin, Tail)
+    end;
+
+origin_allowed(Origin, [_ | Tail]) ->
+    origin_allowed(Origin, Tail).
+
+
+%% @private
+%% Matches "*.example.com" against an origin like "https://sub.example.com:443".
+%% Extracts the host from the origin and checks if it is a subdomain of the
+%% wildcard suffix.
+origin_matches_wildcard(Origin, DomainSuffix) ->
+    case extract_host(Origin) of
+        undefined ->
+            false;
+        Host ->
+            %% Host must end with ".example.com" (the DomainSuffix)
+            %% and must be strictly longer (i.e. have a subdomain part).
+            SuffixWithDot = <<".", DomainSuffix/binary>>,
+            SuffixLen = byte_size(SuffixWithDot),
+            HostLen = byte_size(Host),
+            HostLen > SuffixLen andalso
+                binary:part(Host, HostLen - SuffixLen, SuffixLen) =:= SuffixWithDot
+    end.
+
+
+%% @private
+%% Extracts the host part from an origin string like "https://host:port".
+extract_host(Origin) ->
+    case binary:split(Origin, <<"://">>) of
+        [_Scheme, Rest] ->
+            case binary:split(Rest, <<":">>) of
+                [Host, _Port] -> Host;
+                [Host] -> Host
+            end;
+        _ ->
+            undefined
+    end.
+
+
 %% @private
 build_headers(<<"*">> = Origin, Config) ->
     #{

apps/bondy/test/bondy_http_cors_SUITE.erl

@@ -34,7 +34,12 @@ all() ->
         auto_default_http_port,
         auto_default_https_port,
         custom_methods_and_headers,
-        custom_max_age
+        custom_max_age,
+        wildcard_subdomain_match,
+        wildcard_subdomain_no_match,
+        wildcard_subdomain_exact_domain_no_match,
+        wildcard_subdomain_with_port,
+        wildcard_subdomain_mixed_with_exact
     ].
 
 
@@ -188,6 +193,68 @@ custom_max_age(_Config) ->
 
 
 
+wildcard_subdomain_match(_Config) ->
+    Allowed = [<<"*.example.com">>],
+    Config = config(#{allowed_origins => Allowed}),
+    Req = fake_req(<<"https://app.example.com">>),
+    Headers = bondy_http_cors:headers(Req, Config),
+    ?assertEqual(
+        <<"https://app.example.com">>,
+        maps:get(<<"access-control-allow-origin">>, Headers)
+    ).
+
+
+wildcard_subdomain_no_match(_Config) ->
+    Allowed = [<<"*.example.com">>],
+    Config = config(#{allowed_origins => Allowed}),
+    Req = fake_req(<<"https://evil.com">>),
+    ?assertEqual(#{}, bondy_http_cors:headers(Req, Config)).
+
+
+wildcard_subdomain_exact_domain_no_match(_Config) ->
+    %% "*.example.com" should NOT match "https://example.com" itself —
+    %% only subdomains like "sub.example.com"
+    Allowed = [<<"*.example.com">>],
+    Config = config(#{allowed_origins => Allowed}),
+    Req = fake_req(<<"https://example.com">>),
+    ?assertEqual(#{}, bondy_http_cors:headers(Req, Config)).
+
+
+wildcard_subdomain_with_port(_Config) ->
+    Allowed = [<<"*.example.com">>],
+    Config = config(#{allowed_origins => Allowed}),
+    Req = fake_req(<<"https://app.example.com:8443">>),
+    Headers = bondy_http_cors:headers(Req, Config),
+    ?assertEqual(
+        <<"https://app.example.com:8443">>,
+        maps:get(<<"access-control-allow-origin">>, Headers)
+    ).
+
+
+wildcard_subdomain_mixed_with_exact(_Config) ->
+    %% Mix of wildcard subdomain and exact origin
+    Allowed = [<<"*.example.com">>, <<"https://other.com">>],
+    Config = config(#{allowed_origins => Allowed}),
+    %% Subdomain match
+    Req1 = fake_req(<<"https://app.example.com">>),
+    Headers1 = bondy_http_cors:headers(Req1, Config),
+    ?assertEqual(
+        <<"https://app.example.com">>,
+        maps:get(<<"access-control-allow-origin">>, Headers1)
+    ),
+    %% Exact match
+    Req2 = fake_req(<<"https://other.com">>),
+    Headers2 = bondy_http_cors:headers(Req2, Config),
+    ?assertEqual(
+        <<"https://other.com">>,
+        maps:get(<<"access-control-allow-origin">>, Headers2)
+    ),
+    %% No match
+    Req3 = fake_req(<<"https://nope.com">>),
+    ?assertEqual(#{}, bondy_http_cors:headers(Req3, Config)).
+
+
+
 %% =============================================================================
 %% HELPERS
 %% =============================================================================

doc/guides/configuration/http_security_headers.md

@@ -37,12 +37,20 @@ Controls which origins are permitted to make cross-origin requests. Three modes
 api_gateway.http.cors.allowed_origins = *
 ```
 
-**Explicit allowlist** -- a comma-separated list of exact origins. Only requests whose `Origin` header matches one of these values will receive CORS headers. Requests from unlisted origins receive no `Access-Control-Allow-Origin` header at all, which causes the browser to block the response. When a match is found, `Access-Control-Allow-Credentials` is set to `true` and a `Vary: Origin` header is added:
+**Explicit allowlist** -- a comma-separated list of origins. Only requests whose `Origin` header matches one of these values will receive CORS headers. Requests from unlisted origins receive no `Access-Control-Allow-Origin` header at all, which causes the browser to block the response. When a match is found, `Access-Control-Allow-Credentials` is set to `true` and a `Vary: Origin` header is added.
+
+Entries can be exact origins or wildcard subdomain patterns using the `*.` prefix:
 
 ```
 api_gateway.http.cors.allowed_origins = https://app.example.com, https://admin.example.com
 ```
 
+```
+api_gateway.http.cors.allowed_origins = *.example.com, https://other.com
+```
+
+A wildcard pattern like `*.example.com` matches any subdomain (e.g. `https://app.example.com`, `https://staging.example.com`) but does **not** match the bare domain `https://example.com` itself. The exact requesting origin is always reflected back in the `Access-Control-Allow-Origin` header -- the `*.` is purely a server-side config convenience.
+
 **Auto** -- derives the allowed origin from the incoming request's own scheme, host, and port (`Scheme://Host[:Port]`). This is effectively "same-origin only" and is useful when the frontend application is served from the same domain as the API. Default ports (80 for HTTP, 443 for HTTPS) are omitted:
 
 ```