The django-cors-headers middleware has two ways to control Access-Control-Allow-Origin. One of them is via a regular expression CORS_ALLOWED_ORIGIN_REGEXES, which is a list of strings that are regular expressions. Unfortunately, we've been struggling to use a regex like r"^https://\w+\.example\.com$". That is, we tried
>>> CORS_ALLOWED_ORIGIN_REGEXES: List[str] = config('CORS_ALLOWED_ORIGIN_REGEXES', r"^https://\w+\.example\.com$", cast=Csv())and set the value in the environment, and that didn't work because…
>>> Csv()(r"^https://\w+\.example\.com$")
['^https://w+.example.com$']
which is not the same regular expression we entered. Honestly, the other side of our problem is helmfile, which makes it difficult to set environment variables with backslashes in them, but we thought at least the default in pure python should work, and would be worth reporting.
If you don't use Csv(), the raw string behaves as expected:
>>> config('XYZZY', r'abc\def')
'abc\\def'
The django-cors-headers middleware has two ways to control
Access-Control-Allow-Origin. One of them is via a regular expressionCORS_ALLOWED_ORIGIN_REGEXES, which is a list of strings that are regular expressions. Unfortunately, we've been struggling to use a regex liker"^https://\w+\.example\.com$". That is, we triedand set the value in the environment, and that didn't work because…
which is not the same regular expression we entered. Honestly, the other side of our problem is helmfile, which makes it difficult to set environment variables with backslashes in them, but we thought at least the default in pure python should work, and would be worth reporting.
If you don't use
Csv(), the raw string behaves as expected: