How to use allow subdomains with CORS

gistfile1.txt

# Basically, since we can't use '*' as a wildcard according to the CORS spec, we need to use
# Nginx to conditionally apply it to the "right" subdomains. This should allow all subdomains
# of `yourtld.tld`.

      location ~* ^.+\.(ttf|oft|eot|woff|svg)$ {
                #
                # NOTE: CORS standards allow a specific protocol/host combination,
                # 'null', or '*' only. So, wildcard subdomains won't work.
                #
                # Have a look here:
                #     http://enable-cors.org/server_nginx.html
                #
                if ($http_origin ~* (https?://[^/]*\.yourtld.tld(:[0-9]+)?)$) {
                        add_header 'Access-Control-Allow-Origin' "${http_origin}";
                }
        }

@u2mejc not really, as you would return * only for whitelisted domains.

If you have Access-Control-Allow-Credentials=true, you cannot provide a wildcard for the Access-Control-Allow-Origin. So this is a good use case to allow subdomains access.