### Summary With `namespace_in_path` enabled, three checks in `internal/namespaceinpath` decide whether a host belongs to the pages domain with `strings.HasSuffix(host, pagesDomain)`, without requiring a dot before the pages domain. With pages domain `example.com`, a custom domain such as `myexample.com` passes them as if it were the namespace host `my.example.com`: - `isNamespaceInHost` returns true for it ([`internal/namespaceinpath/middleware.go#L103-110`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/namespaceinpath/middleware.go#L103-110)). The middleware wraps every request when `namespace_in_path` is enabled ([`app.go#L188-190`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/app.go#L188-190)) and answers 404 to a namespace host ([`middleware.go#L44-48`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/namespaceinpath/middleware.go#L44-48)), so every request for that custom domain gets a 404. - `convertToNamespaceInPath` ([`url.go#L54`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/namespaceinpath/url.go#L54)), which the response writer applies to every `Location` header that is not an auth URL ([`responsewriter.go#L38-46`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/namespaceinpath/responsewriter.go#L38-46)), rewrites `https://myexample.com/a-path` into `https://example.com/my/a-path`. Any redirect whose target host ends with the pages domain string is rewritten this way, including a `_redirects` rule with an absolute target. - `isAuthURL` uses the same test ([`responsewriter.go#L93`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/namespaceinpath/responsewriter.go#L93)), so `https://myexample.com/auth` is taken for the auth URL of a namespace host. For such a host that only means its `Location` is left as it is, so it has no visible effect today. Other checks of the pages domain already require the dot: `domainAllowed` in `internal/auth` ([`auth.go#L221`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/auth/auth.go#L221)) and the artifact proxy's host suffix ([`artifact.go#L56`](https://gitlab.com/gitlab-org/gitlab-pages/-/blob/8d3ddba6fd28290b6b16a2cb88349f4c3534abc5/internal/artifact/artifact.go#L56)). ### Steps to reproduce I reproduced it with `gitlab-pages` built from `master` (8d3ddba6fd28290b6b16a2cb88349f4c3534abc5), started against the GitLab API stub the acceptance tests use and the repository's `shared/pages` fixtures. With `-pages-domain domain.com`, the stub's custom domain `test2.my-domain.com` ends with `domain.com` without being a subdomain of it. ```shell go build -o /tmp/gitlab-pages . && go build -o /tmp/stub ./test/gitlabstub/cmd/server /tmp/stub -pages-root "$PWD/shared/pages" & # logs the URL it listens on # /tmp/secret holds GitLabAPISecretKey from internal/fixture/fixtures.go /tmp/gitlab-pages -listen-http 127.0.0.1:8090 -pages-root "$PWD/shared/pages" \ -internal-gitlab-server <stub URL> -api-secret-key /tmp/secret \ -pages-domain domain.com -namespace-in-path & curl -s -o /dev/null -w '%{http_code}\n' -H 'Host: test2.my-domain.com' http://127.0.0.1:8090/ ``` It prints `404`. Without `-namespace-in-path` the same request returns `200`. For the `Location` rewrite, the stub's custom domain `redirects.custom-domain.com` has the `_redirects` rule `/goto-domain.html https://GitLab.com/pages.html 302`. With `-pages-domain ab.com -namespace-in-path`, so that `GitLab.com` ends with the pages domain string: ```shell curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' -H 'Host: redirects.custom-domain.com' http://127.0.0.1:8090/goto-domain.html ``` prints `302 https://ab.com/GitL/pages.html`. Without `-namespace-in-path` it prints `302 https://GitLab.com/pages.html`. The package's test tables have no case for such a host. Adding one for `http://myexample.com/a-path` with pages domain `example.com` to `TestMiddleware_ServeHTTP` gives `404` instead of `200`, and one for `Location: https://myexample.com/a-path` to `TestCustomResponseWriter_WriteHeader` gives `https://example.com/my/a-path` instead of the unchanged `Location`. ### Current behavior With `namespace_in_path` enabled, a custom domain whose name ends with the pages domain string is answered with a 404 on every path, and a redirect to any host whose name ends with that string is sent to the pages domain instead, under a namespace made of the rest of the name (`https://example.com/my/...` for `https://myexample.com/...`). ### Expected behavior Only the pages domain itself and its subdomains are treated as the pages domain. `myexample.com` is served like any other custom domain, and a redirect to it keeps its `Location`. ### Possible fix Require the dot in the three checks, as `domainAllowed` does: `strings.HasSuffix(host, "."+pagesDomain)`, with the port where one is compared. I have a merge request ready for it.