title: .Net Core Configure CORS to allow all subdomains and all localhost ports at the same time
body: <p>I would like to allow CORS requests to a common internal API from all internal websites (<code>*.myintra.net</code>) and also from all <code>localhost</code> ports (for when we are debugging various apps locally in IIS Express, i.e. <code>http://localhost:12345</code>, <code>http://localhost:54321</code>, etc).</p>
  <p><a href="https://stackoverflow.com/a/49943569/2577784">This answer</a> shows me how to use <code>SetIsOriginAllowedToAllowWildcardSubdomains()</code> to allow all subdomains.</p>
  <p><a href="https://stackoverflow.com/a/57539935/2577784">This answer</a> shows me how to allow any <code>localhost</code> port by using a <code>SetIsOriginAllowed()</code> delegate function.</p>
  <p>However, it seems that these options do not work together. My configuration:</p>
  <pre><code>private bool AllowLocalhost(string origin)
  {
      var uri = new Uri(origin);
      return (uri.Host == &quot;localhost&quot;);
  }
  
  public void ConfigureServices(IServiceCollection services)
  {
      services.AddCors(options =&gt;
      {
          string[] corsList = &quot;https://*.myintra.net,https://some.specificurl.com&quot;.Split(&quot;,&quot;);
          options.AddPolicy(&quot;CorsPolicy&quot;, builder =&gt;
          {
              builder
              .WithOrigins(corsList.ToArray())
              .SetIsOriginAllowedToAllowWildcardSubdomains()
              .SetIsOriginAllowed(origin =&gt; AllowLocalhost(origin)) // disallows calls from myapp.myintra.net since it doesn't uri.Host match &quot;localhost&quot;
              ...();
          });
      });
      ...
  }
  </code></pre>
  <p>I can swap the order of the configuration:</p>
  <pre><code>.SetIsOriginAllowed(origin =&gt; AllowLocalhost(origin))
  .SetIsOriginAllowedToAllowWildcardSubdomains()
  </code></pre>
  <p>But then the <code>AllowLocalhost()</code> function is never called. I suppose it makes sense that only one works at a time, since the first check may return <code>true</code>, only to have the second one return <code>false</code>.</p>
  <p>Ideally, I'd like a solution that doesn't involve me having to reimplement the <code>allow wildcard</code> logic inside of my <code>AllowLocalhost()</code> function.</p>
  <p>Also worth noting that I really only need this in a development environment. Production would need to allow wildcards, but disallow <code>localhost</code> no matter the port.</p>