I found the following code in Startup.cs:

app.UseCors(options => options
          .SetIsOriginAllowed(origin => origin.EndsWith("SomeWebsite.com"))
          .AllowAnyMethod()
          .AllowAnyHeader()
          .AllowCredentials()
          .SetPreflightMaxAge(TimeSpan.FromSeconds(2520)
    )

I was concerned with the EndsWith() method.

With the current state of this code, would this mean a website such as maliciousSomeWebsite.com could perform a CSRF attack?

Should the code instead be changed to origin.EndsWith(".SomeWebsite.com")?