openvibers/openvibe.bot Commits

Bot: nginx refuses /internal/ and /metrics case-insensitively (#55)

OP OpenVibers committed 10 Oct 2026 · 797928f96a · 1 file, +2 −2

nginx config only. Express routes case-insensitively, so a case variant such as `/Internal/events` or `/METRICS` slipped past the case-sensitive `location /internal/ { return 404; }` and `location = /metrics { return 404; }` blocks and reached the app. Those paths were still guarded in the app (the Events signature, the loopback check on metrics). Both blocks are now `location ~* ^/internal(/|$)` and `location ~* ^/metrics(/|$)`. The independent security reviews of 2026-10-09/10 found this in several services; this applies it network-wide.

Changes

ddiff --git a/deploy/nginx/openvibe.bot.conf b/deploy/nginx/openvibe.bot.conf
iindex f5c5e54..02e5fa9 100644
---- a/deploy/nginx/openvibe.bot.conf
++++ b/deploy/nginx/openvibe.bot.conf
@@@ -163,7 +163,7 @@ server {
      }
  
      # ── Prometheus metrics: host-local scrapers only (http://127.0.0.1:4630/metrics) ──
--    location = /metrics { return 404; }
++    location ~* ^/metrics(/|$) { return 404; }
  
      # ── The front page and the shared browser assets: Bot's own (server/web/home.js) ──
      # /shared/ is openvibe-shared's serve handler in the app, the same files the Frame loads everywhere.
@@@ -189,7 +189,7 @@ server {
  
      # ── OpenVibe.Events' delivery route: loopback only (POST /internal/events) ──
      # Events posts to http://127.0.0.1:4630/internal/events directly; never proxied from outside (ADR-033).
--    location /internal/ { return 404; }
++    location ~* ^/internal(/|$) { return 404; }
  
      # ── Everything else: the app. There is no static root here any more — the app serves the legal pages,
      # robots.txt, sitemap.xml, manifest.webmanifest and its own 404 page (server/app.js, server/web/routes.js). ──