Cookie-based routing should be case-sensitive.

2 files changed, 25 insertions, 16 deletions

diff --git a/src/nxt_http_route.c b/src/nxt_http_route.c
index d6749acb..ade44666 100644
--- a/src/nxt_http_route.c
+++ b/src/nxt_http_route.c
@@ -475,7 +475,7 @@ nxt_http_route_match_create(nxt_task_t *task, nxt_router_temp_conf_t *tmcf,
 
     if (mtcf.cookies != NULL) {
         table = nxt_http_route_table_create(task, mp, mtcf.cookies,
-                                            NXT_HTTP_ROUTE_COOKIE, 0);
+                                            NXT_HTTP_ROUTE_COOKIE, 1);
         if (table == NULL) {
             return NULL;
         }
@@ -613,7 +613,7 @@ nxt_http_route_rule_name_create(nxt_task_t *task, nxt_mp_t *mp,
         c = name->start[i];
         *p++ = c;
 
-        c = nxt_lowcase(c);
+        c = case_sensitive ? c : nxt_lowcase(c);
         hash = nxt_http_field_hash_char(hash, c);
     }
 
@@ -1452,7 +1452,6 @@ nxt_http_route_cookie(nxt_array_t *array, u_char *name, size_t name_length,
 
     for (p = name; p < name + name_length; p++) {
         c = *p;
-        c = nxt_lowcase(c);
         hash = nxt_http_field_hash_char(hash, c);
     }
 
@@ -1483,8 +1482,7 @@ nxt_http_route_test_cookie(nxt_http_request_t *r,
 
         if (rule->u.name.hash == nv->hash
             && rule->u.name.length == nv->name_length
-            && nxt_strncasecmp(rule->u.name.start, nv->name, nv->name_length)
-               == 0)
+            && nxt_memcmp(rule->u.name.start, nv->name, nv->name_length) == 0)
         {
             ret = nxt_http_route_test_rule(r, rule, nv->value,
                                            nv->value_length);
diff --git a/test/test_routing.py b/test/test_routing.py
index ac2e0de8..ef917ea2 100644
--- a/test/test_routing.py
+++ b/test/test_routing.py
@@ -2423,7 +2423,7 @@ class TestRouting(TestApplicationProto):
             self.get(
                 headers={
                     'Host': 'localhost',
-                    'Cookie': 'foo=bar',
+                    'Cookie': 'foO=bar',
                     'Connection': 'close',
                 },
             )['status'],
@@ -2434,7 +2434,7 @@ class TestRouting(TestApplicationProto):
             self.get(
                 headers={
                     'Host': 'localhost',
-                    'Cookie': ['foo=bar', 'blah=blah'],
+                    'Cookie': ['foO=bar', 'blah=blah'],
                     'Connection': 'close',
                 },
             )['status'],
@@ -2445,7 +2445,7 @@ class TestRouting(TestApplicationProto):
             self.get(
                 headers={
                     'Host': 'localhost',
-                    'Cookie': 'foo=bar; blah=blah',
+                    'Cookie': 'foO=bar; blah=blah',
                     'Connection': 'close',
                 },
             )['status'],
@@ -2461,25 +2461,25 @@ class TestRouting(TestApplicationProto):
                     'Connection': 'close',
                 },
             )['status'],
-            200,
-            'match cookies case insensitive',
+            404,
+            'match cookies case sensitive',
         )
         self.assertEqual(
             self.get(
                 headers={
                     'Host': 'localhost',
-                    'Cookie': 'foo=Bar',
+                    'Cookie': 'foO=Bar',
                     'Connection': 'close',
                 },
             )['status'],
-            200,
-            'match cookies case insensitive 2',
+            404,
+            'match cookies case sensitive 2',
         )
         self.assertEqual(
             self.get(
                 headers={
                     'Host': 'localhost',
-                    'Cookie': 'foo=bar1',
+                    'Cookie': 'foO=bar1',
                     'Connection': 'close',
                 },
             )['status'],
@@ -2490,13 +2490,24 @@ class TestRouting(TestApplicationProto):
             self.get(
                 headers={
                     'Host': 'localhost',
-                    'Cookie': 'foo=bar;',
+                    'Cookie': '1foO=bar;',
                     'Connection': 'close',
                 },
             )['status'],
-            200,
+            404,
             'match cookies exact 2',
         )
+        self.assertEqual(
+            self.get(
+                headers={
+                    'Host': 'localhost',
+                    'Cookie': 'foO=bar;1',
+                    'Connection': 'close',
+                },
+            )['status'],
+            200,
+            'match cookies exact 3',
+        )
 
     def test_routes_match_cookies_empty(self):
         self.assertIn(