Using wildcard in AllowedCorsOrigin of the IdentityServer

Question

Is there a way to use wildcard in AllowedCorsOrigin of the IdentityServer. I want to allow all the sites to access the Sitecore CMS. I tried the following which didn't work.

<AllowedCorsOriginsGroup1>*.site.com</AllowedCorsOriginsGroup1>

One way is to add all the sites in the AllowedCorsOrigin but I want a new site to be added automatically rather than entering the site manually in the AllowedCorsOrigin.

Any suggestion would be appreciated.

Thanks in advance.

Answer 1

Wildcards are not currently supported by Identity Server. There was a similar request in the Identity Server GitHub and the response was:

Wildcards in URLs are always dangerous from a security point of view.

If you need that particular feature and think you can implement it securely for your environment, please use our extensibility points to do it yourself. That's why they exist.

So you can either list all your domains in the config under <AllowedCorsOriginsGroup> or write a custom implementation of ICorsPolicyService and define the method Task<bool> IsOriginAllowedAsync(string origin) to meet your requirements - it should return true if the origin is allowed and false otherwise. Then you can register the class in Identity Server dependency injection container:

services.AddSingleton<ICorsPolicyService>((container) => {
    return new CustomCorsPolicyService();
});

Here is Identity Server documentation for custom Cors Policy services: https://docs.identityserver.io/en/latest/topics/cors.html#custom-cors-policy-service

Answer 2

I am not sure about the wildcard but You can use a pipe sign and write as below:

<AllowedCorsOriginsGroup1>abc.site.com|abc2.site.com|abc3.site.com|abc4.site.com</AllowedCorsOriginsGroup1>