RequireHost with wildcard matches "empty" subdomain

[cincuranet]

When using RequireHost("*.example.com") it also matches .example.com (which is technically invalid, but it matches it nonetheless).

[github-actions]

Triage Summary

Area: area-routing — The issue is about RequireHost() wildcard matching behavior in the endpoint routing's HostMatcherPolicy.
Type: bug — *.example.com matching .example.com (an empty/invalid subdomain) is unintended behavior.

Potential Duplicates

• Allow Host matching based on wildcard suffix #19369 - "Allow Host matching based on wildcard suffix" (similarity: low — related to RequireHost wildcard but requests a different feature)
• No strong duplicates found

Notes

The wildcard pattern *.example.com should only match hosts with at least one non-empty subdomain label (e.g., foo.example.com), not .example.com. The fix would be in HostMatcherPolicy.cs — the MatchHost method's EndsWith check should ensure there is at least one character before the matched suffix (i.e., the host must be strictly longer than the wildcard suffix itself).

Generated by Issue Triage Agent for dotnet/aspnetcore for issue #66581 · ● 149.8K · ◷