openvibers/openrestream Commits

OpenRestream: nginx refuses /internal/ and /metrics case-insensitively (#32)

OP OpenVibers committed 10 Oct 2026 · fe314476ff · 2 files, +3 −3

* OpenRestream: nginx refuses /internal/ and /metrics case-insensitively

nginx config only. Express routes case-insensitively, so a case variant such as `/Internal/events` or `/METRICS` slipped past the case-sensitive `location /internal/ { return 404; }` and `location = /metrics { return 404; }` blocks and reached the app. Those paths were still guarded in the app (the Events signature, the loopback check on metrics). Both blocks are now `location ~* ^/internal(/|$)` and `location ~* ^/metrics(/|$)`. The independent security reviews of 2026-10-09/10 found this in several services; this applies it network-wide.

* test: the vhost refuses /metrics and /internal/ in any letter case

Changes

ddiff --git a/deploy/nginx/openre.stream.conf b/deploy/nginx/openre.stream.conf
iindex 4ab998c..c865f3d 100644
---- a/deploy/nginx/openre.stream.conf
++++ b/deploy/nginx/openre.stream.conf
@@@ -92,7 +92,7 @@ server {
      }
  
      # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:4500/metrics) ──
--    location = /metrics { return 404; }
++    location ~* ^/metrics(/|$) { return 404; }
  
      location / {
          limit_req zone=openre_api burst=40 nodelay;
ddiff --git a/test/deploy-conf.test.js b/test/deploy-conf.test.js
iindex c197983..0e9b897 100644
---- a/test/deploy-conf.test.js
++++ b/test/deploy-conf.test.js
@@@ -74,9 +74,9 @@ test('the openre.stream vhost returns 404 for /metrics, before the catch-all', (
      // at nginx too, so a proxied request never reaches the app.
      const [apex] = serverBlocks(live(conf)).filter((b) => /^\s*server_name\s+openre\.stream\s*;/m.test(b) && /proxy_pass http:\/\/127\.0\.0\.1:4500;/m.test(b));
      assert.ok(apex, 'the apex openre.stream server block that proxies to the API');
--    const metrics = apex.search(/^\s*location\s+=\s+\/metrics\s*\{\s*return\s+404;\s*\}/m);
++    const metrics = apex.search(/^\s*location\s+~\*\s+\^\/metrics\(\/\|\$\)\s*\{\s*return\s+404;\s*\}/m);
      const catchAll = apex.search(/^\s*location\s+\/\s*\{/m);
--    assert.ok(metrics >= 0, 'location = /metrics { return 404; } is present');
++    assert.ok(metrics >= 0, 'location ~* ^/metrics(/|$) { return 404; } is present');
      assert.ok(catchAll >= 0, 'the catch-all location / is present');
      assert.ok(metrics < catchAll, 'the metrics block comes before the catch-all');
  });