Is there a way to use wildcard in AllowedCorsOrigin of the IdentityServer. I want to allow all the sites to access the Sitecore CMS. I tried the following which didn't work.


One way is to add all the sites in the AllowedCorsOrigin but I want a new site to be added automatically rather than entering the site manually in the AllowedCorsOrigin.

Any suggestion would be appreciated.

Thanks in advance.

  • Did you try updating the Sitecore.IdentityServer.Host.xml information using a PowerShell script? Sep 14, 2022 at 6:20
  • Using the Sitecore Powershell Extension?. Will this cause the app pool recycle? @SumitBhatia Sep 14, 2022 at 6:51
  • I am not sure that you need to do this but if you are manually updating the config then a script can do that for you. Sep 14, 2022 at 6:52

2 Answers 2


Wildcards are not currently supported by Identity Server. There was a similar request in the Identity Server GitHub and the response was:

Wildcards in URLs are always dangerous from a security point of view.

If you need that particular feature and think you can implement it securely for your environment, please use our extensibility points to do it yourself. That's why they exist.

So you can either list all your domains in the config under <AllowedCorsOriginsGroup> or write a custom implementation of ICorsPolicyService and define the method Task<bool> IsOriginAllowedAsync(string origin) to meet your requirements - it should return true if the origin is allowed and false otherwise. Then you can register the class in Identity Server dependency injection container:

services.AddSingleton<ICorsPolicyService>((container) => {
    return new CustomCorsPolicyService();

Here is Identity Server documentation for custom Cors Policy services: https://docs.identityserver.io/en/latest/topics/cors.html#custom-cors-policy-service


I am not sure about the wildcard but You can use a pipe sign and write as below:

  • Thanks Himmat, I know about this way of adding sites but I wanted to make a dynamic entry so that when a new site is created, I would not need to add a new site manually in the AllowedCorsOriginsGroup1 Sep 14, 2022 at 5:24
  • You can separate the project for SI and write a patch file and use the code to update dynamically this config. Sep 14, 2022 at 6:30
  • the patch config will cause the app pool recycle. Sep 14, 2022 at 6:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.