Oathkeeper regex rules are case sensitive - a lot web servers / apps are not

[viters]

I think it is worth pointing out, that

is rather:

http://mydomain.com/<(?!protected).*> does not match exactly http://mydomain.com/protected, but will match:

• http://mydomain.com/PROTECTED
• http://mydomain.com/Protected
• http://mydomain.com/ProTecteD
  etc.

Does it create a security trap for someone configuring the rules?

By the way, I know that oathkeeper uses dlclark/regexp2 underneath. It states in description that it is perl compatible. I am not sure if (?!protected).* is perl-compatible, because negative lookahead should only affect letter p with that regex:

http://mydomain.com/<(?!protected).*> would not match any URL with path starting with lower-case p.

[viters]

@aeneasr Probably would be useful to have your opinion here

[aeneasr]

Nice find, thank you @viters! I think we need to improve the docs here. Any contributions are highly appreciated :))

[aeneasr]

/cc @gen1us2k

[vinckr]

Hello @viters,
since this discussion is stale for a while, would you be willing to open an issue for this in ory/docs?
That would help us keep track of it 🙏
I will mark this as answered, but feel free to come back to the discussion any time.

[viters]

@vinckr
Yes, I will.