diff --git a/README.md b/README.md index f6c8fbb..eeba218 100644 --- a/README.md +++ b/README.md @@ -87,7 +87,7 @@ See The [Rails Guide to Rack](http://guides.rubyonrails.org/rails_on_rack.html) * **logger** (Object or Proc): Specify the logger to log to. If a proc is provided, it will be called when a logger is needed. This is helpful in cases where the logger is initialized after `Rack::Cors` is initially configured, like `Rails.logger`. #### Origin -Origins can be specified as a string, a regular expression**, or as '*' to allow all origins. +Origins can be specified as a string, a regular expression, or as '\*' to allow all origins. **\*SECURITY NOTE:** Be careful when using regular expressions to not accidentally be too inclusive. For example, the expression `/https:\/\/example\.com/` will match the domain *example.com.randomdomainname.co.uk*. It is recommended that any regular expression be enclosed with start & end string anchors (`\A\z`).