Description

The current logic of SameOriginCsrfTokenManager is that the hostname must be an exact match and this not configurable. Perhaps a whitelist of allowed domains, or just an option to allow subdomain matches of the same TLD would be useful.

Example

Requests from https://foo.steam250.com should also be allowed to https://bar.foo.steam250.com.