allow passing wildcard domains in serverActions.allowedDomains

docs/02-app/01-building-your-application/02-data-fetching/02-server-actions-and-mutations.mdx

@@ -893,7 +893,7 @@ For large applications that use reverse proxies or multi-layered backend archite
 module.exports = {
   experimental: {
     serverActions: {
-      allowedOrigins: ['my-proxy.com'],
+      allowedOrigins: ['my-proxy.com', '*.my-proxy.com'],
     },
   },
 }

docs/02-app/02-api-reference/05-next-config-js/serverActions.mdx

@@ -15,7 +15,7 @@ A list of extra safe origin domains from which Server Actions can be invoked. Ne
 module.exports = {
   experimental: {
     serverActions: {
-      allowedOrigins: ['my-proxy.com'],
+      allowedOrigins: ['my-proxy.com', '*.my-proxy.com'],
     },
   },
 }

packages/next/src/server/app-render/action-handler.ts

@@ -40,6 +40,7 @@ import {
   getIsServerAction,
   getServerActionRequestMetadata,
 } from '../lib/server-action-request-meta'
+import { isCsrfOriginAllowed } from './csrf-protection'
 
 function formDataFromSearchQueryString(query: string) {
   const searchParams = new URLSearchParams(query)
@@ -331,7 +332,8 @@ export async function handleAction({
     // If the customer sets a list of allowed origins, we'll allow the request.
     // These are considered safe but might be different from forwarded host set
     // by the infra (i.e. reverse proxies).
-    if (serverActions?.allowedOrigins?.includes(originDomain)) {
+    // regex is used to support wildcard domains
+    if (isCsrfOriginAllowed(originDomain, serverActions?.allowedOrigins)) {
       // Ignore it
     } else {
       if (host) {

packages/next/src/server/app-render/csrf-protection.test.ts

@@ -0,0 +1,35 @@
+import { isCsrfOriginAllowed } from './csrf-protection'
+
+describe('isCsrfOriginAllowed', () => {
+  it('should return true when allowedOrigins contains originDomain', () => {
+    expect(isCsrfOriginAllowed('vercel.com', ['vercel.com'])).toBe(true)
+    expect(isCsrfOriginAllowed('www.vercel.com', ['www.vercel.com'])).toBe(true)
+  })
+
+  it('should return true when allowedOrigins contains originDomain with matching regex', () => {
+    expect(isCsrfOriginAllowed('asdf.vercel.com', ['*.vercel.com'])).toBe(true)
+    expect(isCsrfOriginAllowed('asdf.jkl.vercel.com', ['*.vercel.com'])).toBe(
+      true
+    )
+  })
+
+  it('should return false when allowedOrigins contains originDomain with non-matching regex', () => {
+    expect(isCsrfOriginAllowed('asdf.vercel.com', ['*.vercel.app'])).toBe(false)
+  })
+
+  it('should return false when allowedOrigins does not contain originDomain', () => {
+    expect(isCsrfOriginAllowed('vercel.com', ['nextjs.org'])).toBe(false)
+  })
+
+  it('should return false when allowedOrigins is undefined', () => {
+    expect(isCsrfOriginAllowed('vercel.com', undefined)).toBe(false)
+  })
+
+  it('should return false when allowedOrigins is empty', () => {
+    expect(isCsrfOriginAllowed('vercel.com', [])).toBe(false)
+  })
+
+  it('should return false when allowedOrigins is empty string', () => {
+    expect(isCsrfOriginAllowed('vercel.com', [''])).toBe(false)
+  })
+})

packages/next/src/server/app-render/csrf-protection.ts

@@ -0,0 +1,14 @@
+import { isMatch } from 'next/dist/compiled/micromatch'
+
+export const isCsrfOriginAllowed = (
+  originDomain: string,
+  allowedOrigins: string[] | undefined
+): boolean => {
+  return (
+    allowedOrigins?.some(
+      (allowedOrigin) =>
+        allowedOrigin &&
+        (allowedOrigin === originDomain || isMatch(originDomain, allowedOrigin))
+    ) ?? false
+  )
+}

packages/next/src/server/config-shared.ts

@@ -313,7 +313,7 @@ export interface ExperimentalConfig {
      * Allowed origins that can bypass Server Action's CSRF check. This is helpful
      * when you have reverse proxy in front of your app.
      * @example
-     * ["my-app.com"]
+     * ["my-app.com", "*.my-app.com"]
      */
     allowedOrigins?: string[]
   }