Origin wildcard

config.go

@@ -13,7 +13,8 @@ type Config struct {
 // CORSConfig headers configuration.
 type CORSConfig struct {
 	// AllowedOrigin: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
-	AllowedOrigin string `mapstructure:"allowed_origin"`
+	AllowedOrigin         string `mapstructure:"allowed_origin"`
+	AllowedOriginWildcard string `mapstructure:"allowed_origin_wildcard"`
 	// AllowedHeaders: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
 	AllowedHeaders string `mapstructure:"allowed_headers"`
 	// AllowedMethods: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods

plugin.go

@@ -3,6 +3,7 @@ package headers
 import (
 	"fmt"
 	"net/http"
+	"regexp"
 	"strings"
 
 	"github.com/roadrunner-server/errors"
@@ -70,6 +71,13 @@ func (p *Plugin) Init(cfg Configurer) error {
 			opts.AllowedOrigins = strings.Split(p.cfg.CORS.AllowedOrigin, ",")
 		}
 
+		// if this option is set, the content of `AllowedOrigins` is ignored
+		if p.cfg.CORS.AllowedOriginWildcard != "" {
+			opts.AllowOriginFunc = func(origin string) bool {
+				return regexp.MustCompile(p.cfg.CORS.AllowedOriginWildcard).MatchString(origin)
+			}
+		}
+
 		if p.cfg.CORS.AllowedMethods != "" {
 			// trim all spaces
 			p.cfg.CORS.AllowedMethods = strings.Trim(p.cfg.CORS.AllowedMethods, " ")