title: .Net core2 CORS - How SetIsOriginAllowed works?
body: <p>Want to allow my API to be accessed from different sites. For this had:</p>
  
  <pre><code>services
      .AddCors(options =&gt;
      {
          options.AddPolicy(PolicyName, builder =&gt;
          {
              builder
                  .SetIsOriginAllowedToAllowWildcardSubdomains()
                  .WithOrigins(
                      "http://*.my-api.com",
                      "http://*.my-api.service"
                  )
  ...
  </code></pre>
  
  <p>This doesn't seem to allow httpS or when I specify the port in the request. </p>
  
  <p>Ex.:
  <a href="https://www.my-api.com:3000" rel="noreferrer">https://www.my-api.com:3000</a></p>
  
  <p>Thought could replace the WithOrigins with SetIsOriginAllowed()</p>
  
  <pre><code>services
      .AddCors(options =&gt;
      {
          options.AddPolicy(PolicyName, builder =&gt;
          {
              builder
                  .SetIsOriginAllowed(IsOriginAllowed)
  </code></pre>
  
  <p>where IsOriginAllowed function is defined as:</p>
  
  <pre><code>private static bool IsOriginAllowed(string host)
  {
      var corsOriginAllowed = new[] { "my-api.com", "my-api.service" };
  
      return corsOriginAllowed.Any(origin =&gt;
          Regex.IsMatch(host, $@"^http(s)?://.*{origin}(:[0-9]+)?$", RegexOptions.IgnoreCase));
  }
  </code></pre>
  
  <p>but this doesn't work at all, even the regular expression is returning true when I want.</p>
  
  <p>Does anyone know why this doesn't work and can show me the right way to allow httpS (besides duplicating all the domains in WithOrigins() with httpS and different ports.</p>
  
  <p>Thanks</p>