clarified cors wildcard support

apis/middlewares_cors.go

@@ -31,9 +31,11 @@ const (
 // CORSConfig defines the config for CORS middleware.
 type CORSConfig struct {
 	// AllowOrigins determines the value of the Access-Control-Allow-Origin
-	// response header.  This header defines a list of origins that may access the
-	// resource.  The wildcard characters '*' and '?' are supported and are
-	// converted to regex fragments '.*' and '.' accordingly.
+	// response header. This header defines a list of origins that may access the
+	// resource.
+	//
+	// The wildcard characters '*' and '?' are supported as subdomain segments
+	// and are converted to regex fragments '.*' and '.' accordingly.
 	//
 	// Security: use extreme caution when handling the origin, and carefully
 	// validate any logic. Remember that attackers may register hostile domain names.