[#64]: feature: supports regex for origin

config.go

@@ -13,7 +13,8 @@ type Config struct {
 // CORSConfig headers configuration.
 type CORSConfig struct {
 	// AllowedOrigin: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
-	AllowedOrigin string `mapstructure:"allowed_origin"`
+	AllowedOrigin      string `mapstructure:"allowed_origin"`
+	AllowedOriginRegex string `mapstructure:"allowed_origin_regex"`
 	// AllowedHeaders: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
 	AllowedHeaders string `mapstructure:"allowed_headers"`
 	// AllowedMethods: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods

plugin.go

@@ -3,6 +3,7 @@ package headers
 import (
 	"fmt"
 	"net/http"
+	"regexp"
 	"strings"
 
 	"github.com/roadrunner-server/errors"
@@ -31,9 +32,10 @@ type Configurer interface {
 // Plugin serves headers files. Potentially convert into middleware?
 type Plugin struct {
 	// server configuration (location, forbidden files and etc)
-	cfg  *Config
-	prop propagation.TextMapPropagator
-	cors *cors.Cors
+	cfg                *Config
+	prop               propagation.TextMapPropagator
+	cors               *cors.Cors
+	allowedOriginRegex *regexp.Regexp
 }
 
 // Init must return configure service and return true if service hasStatus enabled. Must return error in case of
@@ -70,6 +72,18 @@ func (p *Plugin) Init(cfg Configurer) error {
 			opts.AllowedOrigins = strings.Split(p.cfg.CORS.AllowedOrigin, ",")
 		}
 
+		// if this option is set, the content of `AllowedOrigins` is ignored
+		if p.cfg.CORS.AllowedOriginRegex != "" {
+			var err error
+			p.allowedOriginRegex, err = regexp.Compile(p.cfg.CORS.AllowedOriginRegex)
+			if err != nil {
+				return errors.E(op, err)
+			}
+			opts.AllowOriginFunc = func(origin string) bool {
+				return p.allowedOriginRegex.MatchString(origin)
+			}
+		}
+
 		if p.cfg.CORS.AllowedMethods != "" {
 			// trim all spaces
 			p.cfg.CORS.AllowedMethods = strings.Trim(p.cfg.CORS.AllowedMethods, " ")