Repository navigation
fix: match host names case-insensitively and static prefixes on escaped paths - #270
Merged
Merged
Conversation
exact host lookup was case-sensitive, so ADMIN.example.com could skip an admin.example.com rule with an allowlist and match a broader wildcard or regex rule for the same upstream. A server that equals the host ignoring case now wins before any wildcard or regex server, and the *.example.com suffix check ignores case. Regex servers and the host passed to $host are unchanged. static routes compared the escaped request path with the plain assets root, so a protected "/private docs/" route never matched /private%20docs/x and a broader route served the file. The root is now escaped before the comparison; file serving still uses the plain root. README notes cover host case, escaped route paths, (?i) for case-insensitive upstreams, and reading X-Forwarded-For from the right.
host lookup did not treat `admin.example.com` and `admin.example.com.` as equivalent. A dotted request could lose exact-rule precedence to another regex, while a dotted config key could send the plain spelling to a catch-all. Either could bypass the intended rule's auth or allowlist when the broader rule reached the same backend. Exact and *.example.com server names now ignore one trailing dot on either side. Regex servers are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
more host and path spellings that could skip the auth or IP restriction of a narrower rule, found in a sweep after #269.
ADMIN.example.comcould skip anadmin.example.comrule and match a broader wildcard or regex rule for the same upstream. Exact and*.example.comserver names now match case-insensitively; regex servers and the host passed to$hostare unchangedadmin.example.comandadmin.example.com.were not treated as the same host, so either spelling could miss its exact rule. Exact and*.example.comnames now ignore one trailing dot on either side/private docs/route never matched/private%20docs/xand a broader route served the file. The root is now escaped before the comparisonREADME notes cover host matching, escaped route paths,
(?i)for upstreams that ignore path case, and readingX-Forwarded-Forfrom the right.