title: Does a *.example.com for a content security policy header also match example.com?
body: <p>Say I have this header set on <code>mywebsite.com</code>:</p>
  
  <pre><code>Content-Security-Policy: script-src self https://*.example.com
  </code></pre>
  
  <p>I know it will allow <code>https://foo.example.com</code> and <code>https://bar.example.com</code>, but will it allow <code>https://example.com</code> alone?</p>
  
  <p>Looking at <a href="https://www.w3.org/TR/CSP/" rel="noreferrer">the spec</a>....</p>
  
  <blockquote>
    <p>Hosts such as example.com (which matches any resource on the host, regardless of scheme) or *.example.com (<strong>which matches any resource on the host <em>or</em> any of its subdomains</strong> (and any of its subdomains' subdomains, and so on))</p>
  </blockquote>
  
  <p>...it seems as it should allow plain <code>https://example.com</code>. However, I've found several different sites (<a href="https://www.html5rocks.com/en/tutorials/security/content-security-policy/" rel="noreferrer">site 1</a>, <a href="http://qnimate.com/content-security-policy-in-nutshell/" rel="noreferrer">site 2</a>, <a href="https://scotthelme.co.uk/content-security-policy-an-introduction/" rel="noreferrer">site 3</a>, <a href="https://www.sitepoint.com/improving-web-security-with-the-content-security-policy/" rel="noreferrer">site 4</a>) that <strong>all</strong> say that <code>https://example.com</code> isn't included. Which is it?</p>