MediaHub: nginx refuses /internal/ and /metrics case-insensitively (#7)

OP OpenVibers committed 10 Oct 2026 · 3dac7f3794 · 1 file, +2 −2

nginx config only. Express routes case-insensitively, so a case variant such as `/Internal/events` or `/METRICS` slipped past the case-sensitive `location /internal/ { return 404; }` and `location = /metrics { return 404; }` blocks and reached the app. Those paths were still guarded in the app (the Events signature, the loopback check on metrics). Both blocks are now `location ~* ^/internal(/|$)` and `location ~* ^/metrics(/|$)`. The independent security reviews of 2026-10-09/10 found this in several services; this applies it network-wide.

Changes

ddiff --git a/deploy/nginx/openvibe.download.conf b/deploy/nginx/openvibe.download.conf
iindex 832fac2..d05c44a 100644
---- a/deploy/nginx/openvibe.download.conf
++++ b/deploy/nginx/openvibe.download.conf
@@@ -140,8 +140,8 @@ server {
      }
  
      # ── Loopback only: OpenVibe.Events' deliveries (account export and deletion) and Prometheus ──
--    location /internal/ { return 404; }
--    location = /metrics { return 404; }
++    location ~* ^/internal(/|$) { return 404; }
++    location ~* ^/metrics(/|$) { return 404; }
  
      # ── Pages, docs, robots.txt, sitemap, static assets ─────
      location / {