openvibers/openvibe.sources Commits

Sources: nginx refuses /internal/ and /metrics case-insensitively (#16)

OP OpenVibers committed 10 Oct 2026 · 160a5e65c0 · 2 files, +2 −2

* Sources: nginx refuses /internal/ and /metrics case-insensitively

nginx config only. Express routes case-insensitively, so a case variant such as `/Internal/events` or `/METRICS` slipped past the case-sensitive `location /internal/ { return 404; }` and `location = /metrics { return 404; }` blocks and reached the app. Those paths were still guarded in the app (the Events signature, the loopback check on metrics). Both blocks are now `location ~* ^/internal(/|$)` and `location ~* ^/metrics(/|$)`. The independent security reviews of 2026-10-09/10 found this in several services; this applies it network-wide.

* test: the vhost refuses /metrics and /internal/ in any letter case

Changes

ddiff --git a/deploy/nginx/sources.openvibe.network.conf b/deploy/nginx/sources.openvibe.network.conf
iindex 77f37c6..732291e 100644
---- a/deploy/nginx/sources.openvibe.network.conf
++++ b/deploy/nginx/sources.openvibe.network.conf
@@@ -64,7 +64,7 @@ server {
      location = /release.json { proxy_pass http://127.0.0.1:4720; }
  
      # Metrics are for host-local scrapers only (http://127.0.0.1:4720/metrics).
--    location = /metrics { return 404; }
++    location ~* ^/metrics(/|$) { return 404; }
  
      location = / {
          limit_except GET { deny all; }
ddiff --git a/test/public-host.test.js b/test/public-host.test.js
iindex e3bc407..2d71ef6 100644
---- a/test/public-host.test.js
++++ b/test/public-host.test.js
@@@ -43,7 +43,7 @@ t('the vhost: wildcard certificate, client address from $remote_addr, /metrics 4
      assert.match(conf, /ssl_certificate\s+\/etc\/letsencrypt\/live\/openvibe\.network\/fullchain\.pem;/);
      for (const h of ['X-Real-IP', 'X-Forwarded-For', 'CF-Connecting-IP']) assert.match(conf, new RegExp(`proxy_set_header ${h} \\$remote_addr;`));
      assert.ok(!/proxy_add_x_forwarded_for|\$http_cf_connecting_ip|\$http_x_forwarded_for/.test(conf), 'never a client-sent address');
--    assert.match(conf, /location = \/metrics \{ return 404; \}/);
++    assert.match(conf, /location ~\* \^\/metrics\(\/\|\$\) \{ return 404; \}/, '/metrics is refused in any letter case');
      assert.match(conf, /location \^~ \/api\/v1\/ \{\s*allow 127\.0\.0\.1;\s*allow ::1;\s*deny all;/);
      assert.match(conf, /location \/ \{\s*default_type application\/problem\+json;\s*return 404 '\{/);
      const body = /return 404 '(\{.*\})';/.exec(conf)[1];