location core module and case sensitive matching

[Michał L]

Hello,

I think I found a problem with respecting case sensitive setting at location, here is my test config:

server {
    server_name     test.localhost;

    root d:/public;

    location ~ /ePr {
        proxy_pass   http://192.168.0.2:8080;
    }
}

Requests like this one below goes to proxy, according to ​documentation this is wrong or I miss something.

/epr/Extensions.js"

[Valentin V. Bartenev]

It is expected behaviour on Windows. Location matching in the case-insensitive operating systems always performs in a case-insensitive way.

[Michał L]

Well that's really not what I would expect from http server, but if You say so. Gettin back to apache.

[Maxim Dounin]

Using case-sensitive matching matching by default will likely result in problems (including security ones) due to filesystem itself being case-insensitive. This probably needs to be better documented, but at least ​wiki mentions it.

If you need case-sensitive regexp match under Windows, you may unset the "i" option in regular expression:

location ~ "(?-i)/ePr" {
    ...
}

[Michał L]

Replying to Maxim Dounin:

Using case-sensitive matching matching by default will likely result in problems (including security ones) due to filesystem itself being case-insensitive. This probably needs to be better documented, but at least ​wiki mentions it.

If default setting is case-insensitive there is no risk (IMHO). As a conscious user, Im looking at docs ok, I have an option so I'm setting it but it dosen't work like I would expect to.

Wiki says:

For case-insensitive operating systems, like Mac OS X or Windows with Cygwin, literal >string matching is done in a case insensitive way (0.7.7). However, comparison is limited >to single-byte locale's only.

There is no mentions about case sensitive setting and its dependency on system.

If you need case-sensitive regexp match under Windows, you may unset the "i" option in regular expression:

location ~ "(?-i)/ePr" {
    ...
}

Thanks for Your feedback.

[Maxim Dounin]

Replying to Michał L:

If default setting is case-insensitive there is no risk (IMHO). As a conscious user, Im looking at docs ok, I have an option so I'm setting it but it dosen't work like I would expect to.

It looks like you are under the impression that the "~" means case-sensitive matching. It's not. The "~" means "regexp matching", and "~*" means caseless regexp matching (essentially the same under Windows). The only way to get case-insensitive matching under Windows (and other case-insensitive platforms) is to use embedded regular expression options as outlined above.