Merge pull request #7 from wahyd4/wildcard-domain

Support wildcard domain

Author: wahyd4

README.md

@@ -70,6 +70,8 @@ webauthn:
 cors:
   allowed_origins:
     - "https://your-domain.com"       # Your domain with protocol
+    # Wildcard domains are supported for subdomains:
+    - "*.your-domain.com"             # Matches api.your-domain.com, app.your-domain.com, etc.
 
 auth:
   session_secret: "your-secure-secret-key"  # Generate a secure random string

cors_integration_test.go

@@ -0,0 +1,89 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"passkey-auth/internal/cors"
+)
+
+func TestWildcardCORSIntegration(t *testing.T) {
+	// Create a simple test handler
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("OK"))
+	})
+
+	// Create CORS middleware with wildcard support
+	corsMiddleware := cors.WildcardCORS(cors.Config{
+		AllowedOrigins:   []string{"*.junv.cc", "https://static.example.com"},
+		AllowedMethods:   []string{"GET", "POST", "OPTIONS"},
+		AllowedHeaders:   []string{"*"},
+		AllowCredentials: true,
+	})
+
+	// Wrap the test handler
+	handler := corsMiddleware(testHandler)
+
+	tests := []struct {
+		name           string
+		origin         string
+		expectAllowed  bool
+		expectedOrigin string
+	}{
+		{
+			name:           "wildcard subdomain match",
+			origin:         "https://api.junv.cc",
+			expectAllowed:  true,
+			expectedOrigin: "https://api.junv.cc",
+		},
+		{
+			name:           "wildcard base domain match",
+			origin:         "https://junv.cc",
+			expectAllowed:  true,
+			expectedOrigin: "https://junv.cc",
+		},
+		{
+			name:          "static domain match",
+			origin:        "https://static.example.com",
+			expectAllowed: true,
+		},
+		{
+			name:          "no match",
+			origin:        "https://evil.com",
+			expectAllowed: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create a preflight OPTIONS request
+			req := httptest.NewRequest("OPTIONS", "/", nil)
+			req.Header.Set("Origin", tt.origin)
+			req.Header.Set("Access-Control-Request-Method", "POST")
+
+			// Record the response
+			w := httptest.NewRecorder()
+			handler.ServeHTTP(w, req)
+
+			// Check CORS headers
+			allowOriginHeader := w.Header().Get("Access-Control-Allow-Origin")
+
+			if tt.expectAllowed {
+				if allowOriginHeader == "" {
+					t.Errorf("Expected Access-Control-Allow-Origin header, but got none")
+				}
+
+				// For wildcard matches, should return the specific origin
+				if tt.expectedOrigin != "" && allowOriginHeader != tt.expectedOrigin {
+					t.Errorf("Expected Access-Control-Allow-Origin: %s, got: %s", tt.expectedOrigin, allowOriginHeader)
+				}
+			} else {
+				if allowOriginHeader != "" {
+					t.Errorf("Expected no Access-Control-Allow-Origin header, but got: %s", allowOriginHeader)
+				}
+			}
+		})
+	}
+}

internal/cors/middleware.go

@@ -0,0 +1,68 @@
+package cors
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/rs/cors"
+)
+
+// Config holds the CORS configuration with wildcard support
+type Config struct {
+	AllowedOrigins   []string
+	AllowedMethods   []string
+	AllowedHeaders   []string
+	AllowCredentials bool
+}
+
+// WildcardCORS creates a CORS handler with wildcard domain support
+func WildcardCORS(config Config) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			origin := r.Header.Get("Origin")
+
+			// Determine allowed origins for this request
+			var allowedOrigins []string
+
+			// Separate wildcard and static origins
+			var wildcardPatterns []string
+			var staticOrigins []string
+
+			for _, configuredOrigin := range config.AllowedOrigins {
+				if strings.Contains(configuredOrigin, "*") {
+					wildcardPatterns = append(wildcardPatterns, configuredOrigin)
+				} else {
+					staticOrigins = append(staticOrigins, configuredOrigin)
+				}
+			}
+
+			// Check if origin matches any wildcard pattern
+			if len(wildcardPatterns) > 0 && origin != "" {
+				wildcardMatcher := NewWildcardMatcher(wildcardPatterns)
+				if wildcardMatcher.MatchOrigin(origin) {
+					// For wildcard matches, allow the specific origin
+					allowedOrigins = []string{origin}
+				}
+			}
+
+			// If no wildcard match, use static origins
+			if len(allowedOrigins) == 0 {
+				allowedOrigins = staticOrigins
+			} else {
+				// If we had a wildcard match, also include static origins
+				allowedOrigins = append(allowedOrigins, staticOrigins...)
+			}
+
+			// Create a new CORS instance for this request with the determined origins
+			c := cors.New(cors.Options{
+				AllowedOrigins:   allowedOrigins,
+				AllowedMethods:   config.AllowedMethods,
+				AllowedHeaders:   config.AllowedHeaders,
+				AllowCredentials: config.AllowCredentials,
+			})
+
+			// Use the rs/cors handler
+			c.Handler(next).ServeHTTP(w, r)
+		})
+	}
+}

internal/cors/wildcard.go

@@ -0,0 +1,100 @@
+package cors
+
+import (
+	"strings"
+)
+
+// WildcardMatcher provides wildcard domain matching for CORS origins
+type WildcardMatcher struct {
+	patterns []string
+}
+
+// NewWildcardMatcher creates a new wildcard matcher with the given patterns
+func NewWildcardMatcher(patterns []string) *WildcardMatcher {
+	return &WildcardMatcher{
+		patterns: patterns,
+	}
+}
+
+// MatchOrigin checks if the given origin matches any of the wildcard patterns
+func (m *WildcardMatcher) MatchOrigin(origin string) bool {
+	for _, pattern := range m.patterns {
+		if m.matchPattern(origin, pattern) {
+			return true
+		}
+	}
+	return false
+}
+
+// matchPattern checks if origin matches a specific pattern
+// Supports patterns like:
+// - "*.example.com" matches "api.example.com", "auth.example.com", etc.
+// - "*.*.example.com" matches "api.v1.example.com", etc.
+// - "example.com" matches exactly "example.com"
+func (m *WildcardMatcher) matchPattern(origin, pattern string) bool {
+	// Remove protocol from origin if present
+	origin = strings.TrimPrefix(origin, "https://")
+	origin = strings.TrimPrefix(origin, "http://")
+
+	// Remove port if present
+	if colonIndex := strings.LastIndex(origin, ":"); colonIndex != -1 && colonIndex > strings.LastIndex(origin, "]") {
+		origin = origin[:colonIndex]
+	}
+
+	// Exact match
+	if origin == pattern {
+		return true
+	}
+
+	// Wildcard match
+	if strings.Contains(pattern, "*") {
+		return m.wildcardMatch(origin, pattern)
+	}
+
+	return false
+}
+
+// wildcardMatch performs wildcard matching
+func (m *WildcardMatcher) wildcardMatch(origin, pattern string) bool {
+	// Handle simple case: *.domain.com
+	if strings.HasPrefix(pattern, "*.") {
+		suffix := pattern[2:] // Remove "*."
+
+		// Check if origin ends with the suffix and has at least one subdomain
+		if strings.HasSuffix(origin, "."+suffix) {
+			// Ensure there's a subdomain (not just the suffix itself)
+			prefix := strings.TrimSuffix(origin, "."+suffix)
+			// Make sure the prefix doesn't contain dots (single-level subdomain wildcard)
+			// If you want multi-level subdomains, remove this check
+			return !strings.Contains(prefix, ".")
+		}
+
+		// Also check if origin exactly matches the suffix (without subdomain)
+		return origin == suffix
+	}
+
+	// For more complex patterns, we could implement more sophisticated matching
+	// For now, handle the common *.domain.com case
+	return false
+}
+
+// GetAllowedOrigins returns the actual allowed origins for a request
+// This expands wildcard patterns based on the request origin
+func (m *WildcardMatcher) GetAllowedOrigins(requestOrigin string, staticOrigins []string) []string {
+	allowedOrigins := make([]string, 0, len(staticOrigins))
+
+	for _, origin := range staticOrigins {
+		if strings.Contains(origin, "*") {
+			// This is a wildcard pattern
+			if m.matchPattern(requestOrigin, origin) {
+				// Add the actual request origin instead of the pattern
+				allowedOrigins = append(allowedOrigins, requestOrigin)
+			}
+		} else {
+			// This is a static origin, add as-is
+			allowedOrigins = append(allowedOrigins, origin)
+		}
+	}
+
+	return allowedOrigins
+}