Pattern to determine whether a given URL is for a Salesforce org

Question

My web application receives web hook registration requests for Salesforce instances. Applications other than Salesforce may also register a web hook. What pattern(s) could be used that would reliably distinguish the salesforce org urls from the other URLs? All the orgs that I have seen end in either "force.com" or "salesforce.com" but are there other possible domain names that could be used?

Answer 1

Here is the reference of all URLs and domains Allow the Required Domains

Salesforce uses these domains to deliver content.

• *.content.force.com
• *.force.com
• *.salesforce.com
• *.salesforceliveagent.com (used with Live Agent, Omni-Channel, and SOS)
• *.bluetail.salesforce.com

In addition, these domains are used to deliver content in the right frame of your login screen.

• *.sfdcstatic.com
• secure.eloqua.com
• www.google.*
• *.doubleclick.net
• www.facebook.com
• ssl.google-analytics.com

The right frame content is displayed in the followings URLs.

• login.salesforce.com
• test.salesforce.com
• .salesforce.com

A My Domain URL without custom branding (for example, norns.my.salesforce.com)