Description
Check only a lowercase ASCII host subdomain wildcard; scheme, port and path matching are outside this fragment.
Web protocol data has several layers: a complete message or URL, individual fields or components, and the literal tokens within them. Delimiter presence, spelling, comparison rules, and parser normalization can affect results. A check of one component needs its stated scope before it can be used in a larger parser or policy decision.
Check only a lowercase ASCII host subdomain wildcard; scheme, port and path matching are outside this fragment.
When to use this tool
Use CSP Host Source Subdomain Wildcard Pair when you need one stated URL, header, or protocol-component check in a diagnostic or parser workflow. Supply the input level specified below.
How to use the tool and how it works
- Enter source, host. Use the units and conventions below.
- Run the tool. Correct any format, range, or cross-field input error before interpreting the output.
- Read matches. Inspect matches before interpreting the associated values.
Require a lowercase star-dot source suffix and lowercase host in the implemented ASCII label subset. Return matches when host ends in the dotted suffix and contains an additional prefix before it.1
| Input field | Meaning and units | Accepted input |
|---|---|---|
| source | Source | Required. Text; maximum UTF-16 length 8192. |
| host | Host | Required. Text; maximum UTF-16 length 8192. |
| Output field | Interpretation | Returned shape |
|---|---|---|
| matches | Whether the supplied values match under the particular stated rule. | Required. Boolean. |
{
"input": {
"source": "*.example.com",
"host": "a.example.com"
},
"output": {
"matches": true
}
}Limitations and assumptions
- The bare suffix host does not match and arbitrarily deep subdomains can match. This is lexical suffix matching, without DNS validation, public-suffix rules, schemes, ports, paths, or full CSP evaluation.
- The field tables state structural bounds; the mechanics also specify cross-field constraints. Malformed inputs and unsupported domains cause errors. A successful false flag, empty branch value, or zero placeholder has the meaning stated above and is distinct from an input error.
Alternative or Complementary methods
Use a complete URL or header parser when the task involves an entire field or message. Test actual browser, server, or cache behavior separately when a security or protocol decision depends on more than this component.
References
Similar or alternative tools
- Csp Wildcard Port Source Token
Parse source as a host-like token followed by colon and either star or one through five digits.
- Csp Hash Source Algorithm Token
Parse a single-quoted token containing exactly sha256, sha384, or sha512 followed by a hyphen and a base64-like digest.