Fix CORS wildcard subdomain documentation

[Copilot]

Fixes #36192

The documentation incorrectly stated that SetIsOriginAllowedToAllowWildcardSubdomains() should be called with origins without the * wildcard character. This caused subdomain matching to fail.

Changes

• Code samples: Changed WithOrigins("https://example.com") to WithOrigins("https://*.example.com") in all samples using SetIsOriginAllowedToAllowWildcardSubdomains()
  • Updated 8.0, 6.0, 3.1 samples and legacy CorsExample4
• Documentation text: Replaced "origin should be specified without the * wildcard character" with "The * wildcard character must be included in the origin to enable wildcard subdomain matching"
  • Updated cors.md and include files (cors7.md, cors56.md)
• Metadata: Added ai-usage: ai-assisted, updated ms.date to 11/10/2025

Before (incorrect - no subdomains matched):

policy.WithOrigins("https://example.com")
    .SetIsOriginAllowedToAllowWildcardSubdomains();

After (correct - matches api.example.com, subdomain.example.com, etc.):

policy.WithOrigins("https://*.example.com")
    .SetIsOriginAllowedToAllowWildcardSubdomains();

Original prompt

---

This section details on the original issue you should resolve

<issue_title>CORS wildcard subdomain setup is incorrect</issue_title>
<issue_description>### Description

The CORS documentation regarding wildcard subdomains using SetIsOriginAllowedToAllowWildcardSubdomains incorrectly states that the wildcard character * should be omitted from the domains passed to WithOrigin (e.g. "https://example.com"). Doing so causes no subdomains to be matched, and the CORS middleware does not include the required response header.

When including * in the values passed to WithOrigin (e.g. "https://*.example.com"), subdomains are matched and the CORS middleware correctly includes the required response header.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-8.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/cors.md

Document ID

d3f332c4-4c60-039e-0e1e-bc6b11831f87

Platform Id

fa70aa3f-a2de-be8b-4255-e778a6edb8ff

Article author

@tdykstra

Metadata

• ID: 59bca5db-1196-2a8b-a0d8-4e89b2382288
• PlatformId: fa70aa3f-a2de-be8b-4255-e778a6edb8ff
• Service: aspnet-core
• Sub-service: security

Related Issues</issue_description>

Comments on the Issue (you are @copilot in this section)

@wadepickett Thanks @bradyjerdmann. We appreciate you taking the time to let us know. We will get it fixed. @wadepickett @tdykstra

• Fixes CORS wildcard subdomain setup is incorrect #36192

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/security/cors.md	aspnetcore/security/cors

[wadepickett]

@tdykstra, PR looks good. Approved.