From 997af404a5ef264197acc6d884c4a440afc47cc1 Mon Sep 17 00:00:00 2001
From: drhgencer <gancer16@gmail.com>
Date: Mon, 16 Feb 2026 12:21:34 +0530
Subject: [PATCH] fix(rpc): trim spaces in CORS domain parsing (#22192)

Co-authored-by: DaniPopes <57450786+DaniPopes@users.noreply.github.com>
---
 crates/rpc/rpc-builder/src/cors.rs | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/crates/rpc/rpc-builder/src/cors.rs b/crates/rpc/rpc-builder/src/cors.rs
index c68cf84942..ee0ceb4266 100644
--- a/crates/rpc/rpc-builder/src/cors.rs
+++ b/crates/rpc/rpc-builder/src/cors.rs
@@ -27,7 +27,7 @@ pub(crate) fn create_cors_layer(http_cors_domains: &str) -> Result<CorsLayer, Co
             .allow_origin(Any)
             .allow_headers(Any),
         _ => {
-            let iter = http_cors_domains.split(',');
+            let iter = http_cors_domains.split(',').map(str::trim);
             if iter.clone().any(|o| o == "*") {
                 return Err(CorsDomainError::WildCardNotAllowed {
                     input: http_cors_domains.to_string(),
@@ -51,3 +51,15 @@ pub(crate) fn create_cors_layer(http_cors_domains: &str) -> Result<CorsLayer, Co
     };
     Ok(cors)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_wildcard_with_spaces_rejected() {
+        // Wildcard with leading space should still be rejected
+        let result = create_cors_layer("http://example.com, *");
+        assert!(matches!(result, Err(CorsDomainError::WildCardNotAllowed { .. })));
+    }
+}