DefaultIsOriginAllowed should StringComparer.Ordinal be changed to StringComparer.OrdinalIgnoreCase?

[aspnet-hello]

From @benhysell on Friday, August 11, 2017 11:58:50 AM

https://github.com/aspnet/CORS/blob/8214954d5b0dafe191890da9a3de86f5b607ea69/src/Microsoft.AspNetCore.Cors/Infrastructure/CorsPolicy.cs#L161

Is the only place where string comparison is cased...should it ignore case?

Ran into an issue today where I built my own policy:

services.AddCors(options =>
                {
                    options.AddPolicy("AllowRequestFromWeb",
                        builder =>
                        {
                            builder.WithOrigins(Configuration["ServerOptions:AllowedCorsOrigins"])
                                .AllowAnyHeader()
                                .AllowAnyMethod()
                                .AllowCredentials();
                        });
                });

And I'm reading the configuration in from appsettings.json.

"ServerOptions": {    
    "AllowedCorsOrigins": "http://localhost"
  }

All worked great, but I was having an odd failure with my production appsettings.json. From appsettings.json.Production

"ServerOptions": {    
    "AllowedCorsOrigins": "http://MyCoolProductionServer"
  }

My CORS were failing.

The second I changed "http://MyCoolProductionServer" to lowercase everything worked as expected.

I realize that I cased my server name in my appsettings.json.Production, my mistake...but should that comparison be case sensitive?

Copied from original issue: aspnet/CORS#124

[aspnet-hello]

From @blowdart on Friday, August 11, 2017 12:20:11 PM

It's complicated. So complicated there's an RFC - https://tools.ietf.org/html/rfc4343

Basically for ASCII domains it's case insensitive, but punycode (what Internationalised domain names convert into) kinda, sorta, messed it up.

However, we ought to normalise in our checks, and then allow case sensitivity as an option.

[pranavkm]

This was addressed as part of aspnet/CORS@feceb3d. We still don't punycode i8n names, but this issue can be closed.