Issue Adding Wildcard to the CORS Settings - Cannot Parse URL

I understand your frustration with CORS wildcard settings! Unfortunately, Sanity does not support wildcard subdomains in CORS origins, which is why https://*.netlify.app isn't accepted. This is a security limitation by design.

According to the CORS documentation, you need to add each specific domain individually. So instead of using a wildcard, you'll need to add each Netlify deployment URL separately, like:

• https://your-site-name.netlify.app
• https://staging-branch--your-site-name.netlify.app
• https://preview-branch--your-site-name.netlify.app

Why No Wildcards?

While the CORS specification technically allows wildcards, Sanity doesn't support them when credentials are involved. Since most Sanity client configurations use authentication tokens (which require the "Allow credentials" option), wildcards would create a security risk by potentially exposing your authenticated API access to unintended subdomains on public suffix domains like .netlify.app.

Workarounds for Netlify Preview Deployments

If you're dealing with multiple Netlify preview deployments (which generate unique URLs for each branch/PR), here are some approaches:

1. Use public datasets for previews: If your content doesn't require authentication, you can configure your preview deployments to use the public API without credentials, which doesn't require CORS configuration at all.

2. Add domains as needed: For production and key staging environments, manually add each specific domain through the Sanity Management Dashboard under Settings > API > CORS Origins.

3. Use a reverse proxy: Some teams set up a backend proxy that makes the Sanity API calls server-side, avoiding CORS entirely for preview environments.

4. Netlify Functions: Make Sanity API calls from Netlify Functions (serverless functions) instead of the browser, which bypasses CORS restrictions since server-to-server calls don't involve CORS.

The domain-by-domain approach is the intended security model, even though it's less convenient for dynamic preview URLs on platforms like Netlify. This restriction helps protect your content from unauthorized access across wildcard subdomains on public suffix domains.