SetIsOriginAllowedToAllowWildcardSubdomains ignores final / (path) for wildcard domains but not for exact matches
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
```cs
builder.SetIsOriginAllowedToAllowWildcardSubdomains()
.WithOrigins(["https://test.example.com/"])
```
```cs
builder.SetIsOriginAllowedToAllowWildcardSubdomains()
.WithOrigins(["https://*.example.com/"])
```
Have different behavior. (note the final slash). Obviously we can trim that but the behavior difference should probably mean it warns or something when the path is there. Especially because the `Uri` class seems to add that `/` in it's ToString method.
### Expected Behavior
I would expect when the origin header is `Origin: https://test.example.com` for both of those have the same behavior.
In my opinion both should allow the CORS request, but it should probably also warn the user if it detects that final / and an empty path. Browsers don't seem to send that path. https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin seems to be not in the standard
### Steps To Reproduce
Project.csproj
```xml
net10.0
enable
enable
```
Program.cs
```cs
var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
var testWildcardOrigin = "https://*.example.org/";
var testOrigin = "https://test.example.org/";
builder.Services.AddCors(options =>
{
options.AddPolicy("wildcard", policy =>
{
policy.AllowAnyMethod()
.AllowAnyHeader()
.SetIsOriginAllowedToAllowWildcardSubdomains()
.WithOrigins(testWildcardOrigin)
.AllowCredentials();
});
options.AddPolicy("subdomain", policy =>
{
policy.AllowAnyMethod()
.AllowAnyHeader()
.SetIsOriginAllowedToAllowWildcardSubdomains()
.WithOrigins(testOrigin)
.AllowCredentials();
});
});
var app = builder.Build();
app.UseCors();
// Configure the HTTP request pipeline.
app.MapGet("/wildcard", () => "test wildcard").RequireCors("wildcard");
app.MapGet("/subdomain", () => "test subdomain").RequireCors("subdomain");
app.Run();
```
Test curl command: (change port if appropriate)
```
curl -X OPTIONS -H "Origin: https://test.example.org" -H "Access-Control-Request-Method: GET" -H "Access-Control-Request-Headers: authorization,content-type" -v "http://localhost:5222/wildcard" "http://localhost:5222/subdomain"
```
curl output
```
* Host localhost:5222 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
* Trying [::1]:5222...
* Established connection to localhost (::1 port 5222) from ::1 port 25340
* using HTTP/1.x
> OPTIONS /wildcard HTTP/1.1
> Host: localhost:5222
> User-Agent: curl/8.16.0
> Accept: */*
> Origin: https://test.example.org
> Access-Control-Request-Method: GET
> Access-Control-Request-Headers: authorization,content-type
>
* Request completely sent off
< HTTP/1.1 204 No Content
< Date: Tue, 03 Mar 2026 08:50:03 GMT
< Server: Kestrel
< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Headers: authorization,content-type
< Access-Control-Allow-Methods: GET
< Access-Control-Allow-Origin: https://test.example.org
< Vary: Origin
<
* Connection #0 to host localhost:5222 left intact
* Reusing existing http: connection with host localhost
> OPTIONS /subdomain HTTP/1.1
> Host: localhost:5222
> User-Agent: curl/8.16.0
> Accept: */*
> Origin: https://test.example.org
> Access-Control-Request-Method: GET
> Access-Control-Request-Headers: authorization,content-type
>
< HTTP/1.1 204 No Content
< Date: Tue, 03 Mar 2026 08:50:03 GMT
< Server: Kestrel
<
* Connection #0 to host localhost:5222 left intact
```
### Exceptions (if any)
_No response_
### .NET Version
10.0.102
### Anything else?
ASP.NET Core version: whatever is included by default in the template: Microsoft.NET.Sdk.Web
IDE: Visual Studio 2026
dotnet info
```
.NET SDK:
Version: 10.0.102
Commit: 4452502459
Workload version: 10.0.100-manifests.6d969a7e
MSBuild version: 18.0.7+445250245
Runtime Environment:
OS Name: Windows
OS Version: 10.0.26100
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\10.0.102\
.NET workloads installed:
[maui-windows]
Installation Source: VS 18.2.11415.280
Manifest Version: 10.0.1/10.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.maui\10.0.1\WorkloadManifest.json
Install Type: Msi
[maccatalyst]
Installation Source: VS 18.2.11415.280
Manifest Version: 26.1.10502/10.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.maccatalyst\26.1.10502\WorkloadManifest.json
Install Type: Msi
[ios]
Installation Source: VS 18.2.11415.280
Manifest Version: 26.1.10502/10.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.ios\26.1.10502\WorkloadManifest.json
Install Type: Msi
[android]
Installation Source: VS 18.2.11415.280
Manifest Version: 36.1.2/10.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\10.0.100\microsoft.net.sdk.android\36.1.2\WorkloadManifest.json
Install Type: Msi
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.
Host:
Version: 10.0.2
Architecture: x64
Commit: 4452502459
.NET SDKs installed:
10.0.102 [C:\Program Files\dotnet\sdk]
.NET runtimes installed:
Microsoft.AspNetCore.App 8.0.23 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.23 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.23 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 10.0.2 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]
Environment variables:
Not set
global.json file:
Not found
Learn more:
https://aka.ms/dotnet/info
Download .NET:
https://aka.ms/dotnet/download
```
Contributor guide
Assessment
This issue has not been assessed yet.