From 3da00b296a77ec7d251cd23282f853942aa65d98 Mon Sep 17 00:00:00 2001 From: Mohammed Al Sahaf Date: Tue, 9 Jun 2026 02:29:52 +0300 Subject: [PATCH] admin: fix origin comparison Signed-off-by: Mohammed Al Sahaf --- admin_security_test.go | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/admin_security_test.go b/admin_security_test.go index 48bb5c1f3..a47fb8d93 100644 --- a/admin_security_test.go +++ b/admin_security_test.go @@ -90,12 +90,24 @@ func TestAdminHandlerOriginAllowed(t *testing.T) { want: true, }, { - // Per RFC 3986 section 3.2.2, host names are case-insensitive. - name: "case-sensitive host comparison (potential RFC 3986 deviation)", + // Per RFC 3986 ยง3.2.2, host names are case-insensitive. + name: "host comparison is case-insensitive (allow-list uppercase)", allowedOrigins: []*url.URL{mustParseURL(t, "http://Example.com:8080")}, origin: mustParseURL(t, "http://example.com:8080"), want: true, }, + { + name: "host comparison is case-insensitive (origin uppercase)", + allowedOrigins: []*url.URL{mustParseURL(t, "http://example.com:8080")}, + origin: mustParseURL(t, "http://EXAMPLE.com:8080"), + want: true, + }, + { + name: "host comparison is case-insensitive (mixed case)", + allowedOrigins: []*url.URL{mustParseURL(t, "http://Foo.Bar.Example.com:8080")}, + origin: mustParseURL(t, "http://foo.bar.example.COM:8080"), + want: true, + }, } for _, tc := range tests {