Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?
Short answer
Both are possible (Virtual Host Patterns). If the pattern does not contain *, it is compared exactly with the Host header; if it contains *, the * matches any character sequence, including an empty one, at the place where it is, and the rest of the pattern is looked for exactly. The comparison is always made over the whole Host value; a pattern does not match only a part of the Host. The only wildcard is *; constructs such as ?, [abc] or {a,b} are looked for as plain characters. The *.example.com pattern matches www.example.com and a.b.example.com, and does not match example.com or Host values with a port such as www.example.com:8443; separate patterns are written for the root domain name and for the port (example.com, *.example.com:8443). The comparison is case-sensitive. The interface accepts the * character anywhere in the pattern; WEB-CLI, however, accepts only the *. form at the beginning. For this reason, patterns are written in the *.example.com form.
How Does It Work?
The patterns of a group are compared with the whole Host header of the request; every character other than * (dot, colon, square bracket, question mark) matches itself. The results below have been tested with the comparison rule:
| Pattern | Host header | Result |
|---|---|---|
example.com | example.com | Matches |
example.com | Example.com | Does not match (case-sensitive) |
example.com | example.com:8443 | Does not match (the port is also compared) |
*.example.com | www.example.com | Matches |
*.example.com | a.b.example.com | Matches (* also matches dots) |
*.example.com | example.com | Does not match (the dot after * is required) |
*.example.com | www.example.com:8443 | Does not match (the pattern ends with .example.com) |
*.example.com:8443 | www.example.com:8443 | Matches |
api*.example.com | api2.example.com, api.v2.example.com | Matches (can be entered only from the interface) |
shop?.example.com | shop1.example.com | Does not match (? is a plain character) |
If a Host value fits the patterns of more than one group, the request falls into the group created first (Which host group does a request fall into; what if it matches none?).
Writing Patterns in TR7
| Rule | Practice |
|---|---|
| Root and subdomain names | Two patterns: example.com and *.example.com |
| Non-standard port | The pattern is written with the port: example.com:8443, *.example.com:8443 |
| Case | Patterns are written in the form the clients send (usually lowercase) |
| Wildcard position | Accepted anywhere in the interface; WEB-CLI accepts only *. at the beginning; if the groups will also be edited with WEB-CLI, * is used only at the beginning |
| Other glob constructs | ?, [], {} are not used; they are looked for as plain characters |
Patterns are written in the Virtual Host Patterns field when the group is added or in the Edit window of the group (How is a Host Group added; what goes into the Virtual Host Patterns field?). The default group does not have this field (WAF Mode · Virtual Host Patterns).
The glob syntax in path patterns is a different mechanism; in page types, * is limited to one path segment and ** crosses the segment boundary (What is the difference between an Exact Path and a glob path?).
Common Misconceptions
- "
*.example.comalso covers the root domain name." A second pattern is needed forexample.com. - "
*.example.comalso matches Hosts with a port." Since the pattern ends with.example.com,www.example.com:8443does not match; for publishing on a port,*.example.com:8443is written. - "Host matching is case-insensitive." The pattern and the Host must be in the same letter case.
- "
?is a single-character wildcard." Only*is a wildcard; the other characters are looked for exactly.
How it is done in the documentation
