Please support domain matching in the CORS config

[jmillikin-stripe]

Description:
The envoy.cors filter injects CORS headers. Currently the outgoing Access-Control-Allow-Origin header is set from a hardcoded set of domains in the Envoy config, so you must know the string-exact name of each domain that will be making requests to the service.

It'd be nice if Envoy could support matching (regex, wildcard, or whatever) on the incoming Origin header. If a match is found, then the outgoing Access-Control-Allow-Origin would be set to the origin as provided by the client.

This would let CORS be useful for sites on dynamically-generated domain names, for example when using a temporary website instance allocated per Github PR.

Relevant Links:

• Setting Access-Control-Allow-Origin: * has security implications, so we'd like to avoid it.
• Example nginx config for CORS with dynamic origins

[mattklein123]

SGTM if anyone would like to work on this.

[alyssawilk]

@codesuki in case he's interested :-)

[codesuki]

I am down for it. This is a feature I wanted to implement in the beginning. But the earliest I could start to work on it is middle to end of March. So if nobody picks it up until then, I will.