Origin validation Bypass

In the following python script

    if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
        origin = request.headers.get('Origin', None)
        if origin and not origin.startswith(request.base):
            raise cherrypy.HTTPError(403, 'Unexpected Origin header')

Explanation:

In the above lines of code, The origin is being only validated from the start of domain name only https://rdiffweb-demo.ikus-soft.com. But it isn’t validated after the actual domain name https://rdiffweb-demo.ikus-soft.com .nithissh.com

For Example,

If we enter the following domain https://nithissh.com.rdiffweb-demo.ikus-soft.com as an origin and then the origin header being validated and returns a 403 status as expected in the code

But Now we can bypass the above validation check, By a creating subdomain after the soft.com.^ as follows https://rdiffweb-demo.ikus-soft.com .nithissh.com.