title: Configure cors to allow all subdomains using ASP.NET Core (Asp.net 5, MVC6, VNext)
body: <p>I have cors setup correctly in an ASP.NET Core web app. Im using the following package...</p>
  
  <pre><code>"Microsoft.AspNet.Cors": "6.0.0-rc1-final"
  </code></pre>
  
  <p>and here is the startup.cs snippet...</p>
  
  <pre><code>public virtual IServiceProvider ConfigureServices(IServiceCollection services)
  {
      services.AddCors
      (
          options =&gt;
          {
              options.AddPolicy
              (
                  CORSDefaults.PolicyName, 
                  builder =&gt;
                  {
                      //From config...
                      var allowedDomains = new []{"http://aaa.somewhere.com","https://aaa.somewhere.com","http://bbb.somewhere.com","https://bbb.somewhere.com"};
  
                      //Load it
                      builder
                          .WithOrigins(allowedDomains)
                          .AllowAnyHeader()
                          .AllowAnyMethod()
                          .AllowCredentials();
                  }
              );
          }
      );
  }
  </code></pre>
  
  <p>This works great except that the list of subdomains to allow is growing fast and I want to allow all subdomains of "somewhere.com". Something like "*.somewhere.com". I cant seem to find any documentation on how to do this in the new ASP.NET Core (MVC6, ASP.NET5, VNext). All the docs/examples I'm finding that demonstrate how to do this are for earlier versions of MVC or WebApi. How can I achieve this in the new stack?</p>