How to use allow subdomains with CORS

gistfile1.txt

# Basically, since we can't use '*' as a wildcard according to the CORS spec, we need to use
# Nginx to conditionally apply it to the "right" subdomains. This should allow all subdomains
# of `yourtld.tld`.

      location ~* ^.+\.(ttf|oft|eot|woff|svg)$ {
                #
                # NOTE: CORS standards allow a specific protocol/host combination,
                # 'null', or '*' only. So, wildcard subdomains won't work.
                #
                # Have a look here:
                #     http://enable-cors.org/server_nginx.html
                #
                if ($http_origin ~* (https?://[^/]*\.yourtld.tld(:[0-9]+)?)$) {
                        add_header 'Access-Control-Allow-Origin' "${http_origin}";
                }
        }

I don't get this: on the enable-cors.org website it says, verbatim:

For simple CORS requests, the server only needs to add the following header to its response:

Access-Control-Allow-Origin: *

Some how this is my #2 in google results for cors subdomain. @aijanai there is a known issue open for that specific sentence, the issue explains the problem: monsur/enable-cors.org#108

Access-Control-Allow-Origin: * defeats the purpose of CORS, which is to prevent XSS.

@u2mejc not really, as you would return * only for whitelisted domains.

If you have Access-Control-Allow-Credentials=true, you cannot provide a wildcard for the Access-Control-Allow-Origin. So this is a good use case to allow subdomains access.