tomchristie: Absolutely, thanks!
diff --git a/starlette/middleware/cors.py b/starlette/middleware/cors.py
index ad2eeff..90ba180 100644
--- a/starlette/middleware/cors.py
+++ b/starlette/middleware/cors.py
@@ -87,7 +87,7 @@ class CORSMiddleware:
         if self.allow_all_origins:
             return True
 
-        if self.allow_origin_regex is not None and self.allow_origin_regex.match(
+        if self.allow_origin_regex is not None and self.allow_origin_regex.fullmatch(
             origin
         ):
             return True

Dangerous example regex for CORS Middleware?
Looking at the docs for CORS Middlware here: https://www.starlette.io/middleware/#corsmiddleware , under the `allow_origin_regex` attribute, the example value is `https://.*\.example\.org`.

However, based on the handler code for this at https://github.com/encode/starlette/blob/ab86530eddfcf56e0f7e5ca56f6ab69c15594a7d/starlette/middleware/cors.py#L90 , it appears `https://www.example.org.hacker.com` would pass as a valid origin, right?

It seems like the example should be `https://.*\.example\.org$`, yes?
diff --git a/tests/middleware/test_cors.py b/tests/middleware/test_cors.py
index bcba704..e8bf72f 100644
--- a/tests/middleware/test_cors.py
+++ b/tests/middleware/test_cors.py
@@ -122,7 +122,7 @@ def test_cors_allow_origin_regex():
     app.add_middleware(
         CORSMiddleware,
         allow_headers=["X-Example", "Content-Type"],
-        allow_origin_regex="https://*",
+        allow_origin_regex="https://.*",
     )
 
     @app.route("/")
@@ -171,6 +171,39 @@ def test_cors_allow_origin_regex():
     assert "access-control-allow-origin" not in response.headers
 
 
+def test_cors_allow_origin_regex_fullmatch():
+    app = Starlette()
+
+    app.add_middleware(
+        CORSMiddleware,
+        allow_headers=["X-Example", "Content-Type"],
+        allow_origin_regex="https://.*\.example.org",
+    )
+
+    @app.route("/")
+    def homepage(request):
+        return PlainTextResponse("Homepage", status_code=200)
+
+    client = TestClient(app)
+
+    # Test standard response
+    headers = {"Origin": "https://subdomain.example.org"}
+    response = client.get("/", headers=headers)
+    assert response.status_code == 200
+    assert response.text == "Homepage"
+    assert (
+        response.headers["access-control-allow-origin"]
+        == "https://subdomain.example.org"
+    )
+
+    # Test diallowed standard response
+    headers = {"Origin": "https://subdomain.example.org.hacker.com"}
+    response = client.get("/", headers=headers)
+    assert response.status_code == 200
+    assert response.text == "Homepage"
+    assert "access-control-allow-origin" not in response.headers
+
+
 def test_cors_credentialed_requests_return_specific_origin():
     app = Starlette()
 

pip install -e .[full]
parse_log_pytest
requirements.txt
pytest
./scripts/install
3.7
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
aiofiles==23.2.1
aiosqlite==0.19.0
autoflake==2.1.1
Babel==2.14.0
black==23.3.0
certifi @ file:///croot/certifi_1671487769961/work/certifi
charset-normalizer==3.4.1
click==8.1.8
colorama==0.4.6
coverage==7.2.7
databases==0.8.0
exceptiongroup==1.2.2
ghp-import==2.1.0
graphene==3.4.3
graphql-core==3.2.6
graphql-relay==3.2.0
greenlet==3.1.1
idna==3.10
importlib-metadata==6.7.0
iniconfig==2.0.0
isort==5.11.5
itsdangerous==2.1.2
Jinja2==3.1.6
Markdown==3.4.4
MarkupSafe==2.1.5
mergedeep==1.3.4
mkautodoc==0.2.0
mkdocs==1.5.3
mkdocs-material==9.2.7
mkdocs-material-extensions==1.2
mypy==1.4.1
mypy-extensions==1.0.0
packaging==24.0
paginate==0.5.7
pathspec==0.11.2
platformdirs==4.0.0
pluggy==1.2.0
pyflakes==3.0.1
Pygments==2.17.2
pymdown-extensions==10.2.1
pytest==7.4.4
pytest-cov==4.1.0
python-dateutil==2.9.0.post0
python-multipart==0.0.8
pytz==2025.2
PyYAML==6.0.1
pyyaml_env_tag==0.1
regex==2022.10.31
requests==2.31.0
six==1.17.0
SQLAlchemy==1.4.54
-e git+https://github.com/encode/starlette.git@5c43dde0ec0917673bb280bcd7ab0c37b78061b7#egg=starlette
tomli==2.0.1
typed-ast==1.5.5
typing_extensions==4.7.1
ujson==5.7.0
urllib3==2.0.7
watchdog==3.0.0
zipp==3.15.0

name: starlette
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=22.3.1=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - aiofiles==23.2.1
      - aiosqlite==0.19.0
      - autoflake==2.1.1
      - babel==2.14.0
      - black==23.3.0
      - charset-normalizer==3.4.1
      - click==8.1.8
      - colorama==0.4.6
      - coverage==7.2.7
      - databases==0.8.0
      - exceptiongroup==1.2.2
      - ghp-import==2.1.0
      - graphene==3.4.3
      - graphql-core==3.2.6
      - graphql-relay==3.2.0
      - greenlet==3.1.1
      - idna==3.10
      - importlib-metadata==6.7.0
      - iniconfig==2.0.0
      - isort==5.11.5
      - itsdangerous==2.1.2
      - jinja2==3.1.6
      - markdown==3.4.4
      - markupsafe==2.1.5
      - mergedeep==1.3.4
      - mkautodoc==0.2.0
      - mkdocs==1.5.3
      - mkdocs-material==9.2.7
      - mkdocs-material-extensions==1.2
      - mypy==1.4.1
      - mypy-extensions==1.0.0
      - packaging==24.0
      - paginate==0.5.7
      - pathspec==0.11.2
      - platformdirs==4.0.0
      - pluggy==1.2.0
      - pyflakes==3.0.1
      - pygments==2.17.2
      - pymdown-extensions==10.2.1
      - pytest==7.4.4
      - pytest-cov==4.1.0
      - python-dateutil==2.9.0.post0
      - python-multipart==0.0.8
      - pytz==2025.2
      - pyyaml==6.0.1
      - pyyaml-env-tag==0.1
      - regex==2022.10.31
      - requests==2.31.0
      - six==1.17.0
      - sqlalchemy==1.4.54
      - tomli==2.0.1
      - typed-ast==1.5.5
      - typing-extensions==4.7.1
      - ujson==5.7.0
      - urllib3==2.0.7
      - watchdog==3.0.0
      - zipp==3.15.0
prefix: /opt/conda/envs/starlette

tests/middleware/test_cors.py::test_cors_allow_origin_regex_fullmatch
tests/middleware/test_cors.py::test_cors_allow_all tests/middleware/test_cors.py::test_cors_allow_specific_origin tests/middleware/test_cors.py::test_cors_disallowed_preflight tests/middleware/test_cors.py::test_cors_allow_origin_regex tests/middleware/test_cors.py::test_cors_credentialed_requests_return_specific_origin tests/middleware/test_cors.py::test_cors_vary_header_defaults_to_origin tests/middleware/test_cors.py::test_cors_vary_header_is_properly_set tests/middleware/test_cors.py::test_cors_allowed_origin_does_not_leak_between_credentialed_requests
starlette/middleware/cors.py
starlette/middleware/cors.py