Updates to CORS patterns contribution

Closes gh-25016

spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc.xsd

@@ -1346,6 +1346,15 @@
 	Comma-separated list of origins to allow, e.g. "https://domain1.com, https://domain2.com".
 	The special value "*" allows all domains (default).
 
+	For matching pre-flight and actual requests the "Access-Control-Allow-Origin"
+	response header is set either to the matched domain value or to "*".
+	Keep in mind however that the CORS spec does not allow "*" when allow-credentials
+	is set to true and that is rejected as of 5.3. See allowed-origin-patterns for
+	further options.
+
+	By default all origins are allowed unless allowed-origin-patterns is also set
+	in which case allowed-origin-patterns is used instead.
+
 	Note that CORS checks use values from "Forwarded" (RFC 7239), "X-Forwarded-Host",
 	"X-Forwarded-Port", and "X-Forwarded-Proto" headers, if present, in order to reflect
 	the client-originated address. Consider using the ForwardedHeaderFilter in order to
@@ -1354,6 +1363,20 @@
 								]]></xsd:documentation>
 							</xsd:annotation>
 						</xsd:attribute>
+						<xsd:attribute name="allowed-origin-patterns" type="xsd:string">
+							<xsd:annotation>
+								<xsd:documentation><![CDATA[
+	Alternative to allowed-origins that supports origins declared via patterns.
+	In contrast to allowed-origins which does support the special value "*", this
+	property allows more flexible patterns, e.g. "*.domain1.com". Furthermore it
+	always sets the "Access-Control-Allow-Origin" response header to the matched
+	origin and never to "*" nor to any other pattern and therefore can be used in
+	combination with allowCredentials set to true.
+
+	By default this is not set.
+								]]></xsd:documentation>
+							</xsd:annotation>
+						</xsd:attribute>
 						<xsd:attribute name="allowed-methods" type="xsd:string">
 							<xsd:annotation>
 								<xsd:documentation><![CDATA[