Using wildcard for subdomain in Access-Control-Allow-Origin
<p>I'm using Express for my website and using credential xhr. I want to request to <code>http://example.com</code> from <code>http://admin.example.com</code> or <code>http://service1.example.com</code>, and this is my <code>Access-Control-Allow-Origin</code> part in express server:</p>

<pre><code>// CORS
app.use((req, res, next) =&gt; {
    res.setHeader('Access-Control-Allow-Origin', 'http://*.example.com');
    res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,Content-Type');
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, DELETE');
    next();
});
</code></pre>

<p>But when I try credential xhr from <strong><a href="http://admin.example.com" rel="noreferrer">http://admin.example.com</a></strong> to <strong><a href="http://example.com" rel="noreferrer">http://example.com</a></strong>, it fails with:</p>

<blockquote>
  <p>Fetch API cannot load <code>http://example.com/api/v1/authentication/signin</code>.
  Response to preflight request doesn't pass access control check: The
  '<code>Access-Control-Allow-Origin</code>' header has a value '<code>http://*.example.com</code>'
  that is not equal to the supplied origin. Origin
  '<a href="http://admin.example.com" rel="noreferrer">http://admin.example.com</a>' is therefore not allowed access. Have the
  server send the header with a valid value, or, if an opaque response
  serves your needs, set the request's mode to 'no-cors' to fetch the
  resource with CORS disabled.</p>
</blockquote>

<p>Looks like it causes from browser didn't understood what exactly <code>*.example.com</code> means, and refuse the request.</p>

<p>I want to request from these domains:</p>

<ul>
<li>example.com</li>
<li>admin.example.com</li>
<li>service1.example.com</li>
<li>service2.example.com</li>
<li>[anything].example.com</li>
</ul>

<p>I'm using Fetch API for XHR, and set <code>credentials: true</code>. Is there a something that I missed? Any advice will very appreciate it.</p>