Bounded wildcard support?
See original GitHub issueThis library uses HttpOriginRange
from akka-http to perform its matching.
Unfortunately, there is no way to extend HttpOriginRange
or HttpOrigin
in order to support more sophisticated/alternate matching.
This means that whilst it’s possible to match all hosts (HttpOriginRange.*
) or a set of fixed hosts (HttpOriginRange.Default(...)
), it’s not possible for CORS purposes to match for example *.somedomain.com
.
I would open this as an issue upstream, but it’s unclear to me whether this is a request that’s applicable to other uses of their HttpOriginRange
or is specific to akka-http-cors
’s use of it.
So in summary:
- Would it be possible here to add support for matching on bounded wildcards.
- Should this issue go upstream to
akka-http
instead?
Issue Analytics
- State:
- Created 6 years ago
- Reactions:1
- Comments:7 (4 by maintainers)
Top Results From Across the Web
Upper Bounded Wildcards - The Java™ Tutorials
To declare an upper-bounded wildcard, use the wildcard character ('?'), followed by the extends keyword, followed by its upper bound. Note that, in...
Read more >Item 31: Use bounded wildcards to increase API flexibility
More generally, the wildcard is required to support types that do not implement Comparable (or Comparator) directly but extend a type that does....
Read more >Java: bounded wildcards or bounded type parameter?
A wildcard can have only one bound, while a type parameter can have several bounds. A wildcard can have a lower or an...
Read more >Wildcards in Java
To declare an upper-bounded wildcard, use the wildcard character ('?'), followed by the extends keyword, followed by its upper bound.
Read more >Bounded Generic Types & Wildcards - [OOP & Java #6]
Continuing on the topic of Generics: Bounded generic types <T ... to support polymorphism, we can make use of wildcards to achieve the...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
I will have a look again at this then, I think I remember I had an issue implementing it.
Hey, I knew one day someone would raise this issue 😉
Modifying
HttpOriginRange
orHttpOrigin
is impracticable for two reasons:HttpOrigin
is strictly defined in RFC-6454 and it doesn’t allow some matching segments. AHttpOrigin
is used in many places and we can’t modify his semantic for CORS.Access-Control-Allow-Origin
header and the W3C defines its content strictly.I looked at other CORS implementations to see how they deal with this:
allowSubdomains
.Adding a new setting
allowSubdomains
is possible, but this mechanism is not defined by the W3C. This setting would only change the matching logic, not the content of theAccess-Control-Allow-Origin
header.Thoughts?