Add optional support for CORS allow_origin_regex #52155

Description

I'm mainly writing this as an issue to check if there are any security concerns or objections to this feature. If not, I'm happy to put together a PR for this.

Currently, Airflow's access_control_allow_origins option can only specify a wildcard (*) or a list of origins with the exact protocol-host-port values (e.g. http://localhost:1234,https://localhost443. Ideally, Airflow's api config could also support a regex pattern for the allowed origins.

Use case/motivation

Since the various Airflow API access_control_allow_* config options are fed directly into FastAPIs CORSMiddleware, and since that middleware class has an optional allow_origin_regex argument, it seems natural to extend Airflow's CORS config options to support that field as well. This could prove particularly useful for Airflow deployments which may interact with frontend components operating with dynamic hostnames, as just one example.

Related issues

No response

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct