src/com/thetransactioncompany/cors/CORSConfiguration.java
public final boolean isAllowedSubdomainOrigin(final Origin origin) {
		
		try {
			ValidatedOrigin validatedOrigin = origin.validate();
			
			String scheme = validatedOrigin.getScheme();
			String suffix = validatedOrigin.getSuffix();
			
			for (ValidatedOrigin allowedOrigin: allowedOrigins) {
				
				if (suffix.endsWith("." + allowedOrigin.getSuffix()) && 
				    scheme.equalsIgnoreCase(allowedOrigin.getScheme()))

					return true;
			}
			
		} catch (OriginException e) {
    			
			return false;
		}
		
		return false;
	}
public final boolean isAllowedSubdomainOrigin(final Origin origin) {
		
		try {
			ValidatedOrigin validatedOrigin = origin.validate();
			
			String scheme = validatedOrigin.getScheme();
			String suffix = validatedOrigin.getSuffix();
			
			for (ValidatedOrigin allowedOrigin: allowedOrigins) {
				
				if (suffix.endsWith("." + allowedOrigin.getSuffix()) && 
				    scheme.equalsIgnoreCase(allowedOrigin.getScheme()))

					return true;
			}
			
		} catch (OriginException e) {
    			
			return false;
		}
		
		return false;
	}
Helper method to check whether the specified origin is a subdomain
origin of the {@link #allowedOrigins}. This is done by looking up the
origin's scheme, hostname and port and matching them with each of the
{@link #allowedOrigins}.

<p>Example:

<p>{@code Origin: https://foo.example.com } matches
{@code cors.allowedOrigin = https://example.com } whereas
{@code cors.allowedOrigin = http://example.com } would not match.

@param origin The origin as reported by the web client (browser),
{@code null} if unknown.

@return {@code true} if the origin is an allowed subdomain origin,
else {@code false}.