Add wildcard host matching to AllowedHostsValidator

[David Blain (dabla)]

Support wildcard patterns in the allowlist so trusted host groups can be managed without listing every subdomain explicitly. Keep strict host normalization and validation to preserve safe trust decisions.

Overview

This PR extends AllowedHostsValidator to support wildcard-style host matching via suffix entries (for example, .fabric.microsoft.com) while preserving exact-match behavior.

This is needed for APIs that use dynamic or tenant-specific subdomains, where enumerating every hostname is not practical. With this change, callers can keep host validation enabled instead of falling back to an empty allowed_hosts list.

Related Issue

Fixes #700

Demo

validator = AllowedHostsValidator([".fabric.microsoft.com"])

validator.is_url_host_valid("https://2c662c47.z2c.graphql.fabric.microsoft.com")  # True
validator.is_url_host_valid("https://fabric.microsoft.com")                         # False

Notes

Suffix entries are intentionally subdomain-only:

• .fabric.microsoft.com matches foo.fabric.microsoft.com
• .fabric.microsoft.com does not match fabric.microsoft.com

Exact host entries continue to work as before.

Testing Instructions

• Check out this branch
• From repo root, run:
  • pwsh -File .\kiota-python.ps1 test
• Or run package-scoped tests:
  • Set-Location .\packages\abstractions
  • poetry install
  • poetry run pytest .\tests\authentication\test_allowed_hosts_validator.py
• Verify expected behavior:
  • wildcard/suffix entries match dynamic subdomains
  • bare domain is rejected for suffix entries
  • matching is case-insensitive
  • set_allowed_hosts(...) keeps suffix behavior

[Vincent Biret (baywet)]

Thanks for the contribution!

Would you be willing to make the same contribution in other languages to align the behaviour?

[Vincent Biret (baywet)]

(also can you please run the formatting command)

[Copilot]

Pull request overview

This PR extends AllowedHostsValidator (abstractions auth) to support suffix-based “wildcard” allowlist entries (domains prefixed with ".") so callers can allow dynamic subdomains without disabling host validation.

Changes:

• Add suffix matching in AllowedHostsValidator.is_url_host_valid(...) for allowlist entries that start with "." (subdomain-only).
• Add/extend unit tests covering suffix matching behavior, including bare-domain rejection and case-insensitivity.
• Ensure set_allowed_hosts(...) updates continue to preserve suffix matching behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/abstractions/kiota_abstractions/authentication/allowed_hosts_validator.py	Adds suffix-based allowlist matching while keeping exact-match behavior.
packages/abstractions/tests/authentication/test_allowed_hosts_validator.py	Adds test coverage for suffix matching, bare-domain rejection, case-insensitivity, and post-update behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[David Blain (dabla)]

(also can you please run the formatting command)

This code has been reformatted and pushed, but I think workflows nee to be approved to be allowed to run again.

[Vincent Biret (baywet)]

Thank you for making the changes!

Yes, in general on any Microsoft owned repository, workflows need an approval before they can run for security reasons.

Would you be willing to reproduce the change across the other repositories?