Fix Lowercase Pages URLs Redirect Loop with Mixed-Case Project Slugs

Rishi Prasad Sulakherequested to merge
gitlab-community/gitlab-org/gitlab:fix-mixed-case-project-url into master

What does this MR do and why?

This MR fixes #526293. When a project has a mixed-case slug (e.g., "MyTestProject") and "Use unique domain" is disabled, accessing the Pages URL with a lowercase version of the project path causes redirect loops during authentication.

Example scenario:

Root Cause Analysis

The issue is in the LookupPath#prefix_value method which uses a case-sensitive delete_prefix operation:

https://gitlab.com/gitlab-org/gitlab/-/blame/master/app/models/pages/lookup_path.rb#L79 The problem chain:

  • VirtualHostFinder (line 7) downcases the incoming host: @host = host&.downcase
  • Namespace lookup (via Namespace.by_path) is case-insensitive, but returns namespace.full_path with original case
  • VirtualDomain is created with trim_prefix: namespace.full_path preserving the original case (e.g., "MyGroup")
  • LookupPath#prefix_value uses project.full_path.delete_prefix(trim_prefix) which is case-sensitive

When the gitlab-pages daemon receives a request for /mytestproject but the lookup path prefix is /MyTestProject/, the path matching fails, causing the authentication redirect loop.

Solution

Normalize the trim_prefix to match the case of how paths are accessed (lowercase), ensuring consistent case-insensitive path matching.

Files Modify:

  1. gitlab/app/models/pages/lookup_path.rb Modified prefix_value method to use case-insensitive prefix removal
  2. gitlab/spec/models/pages/lookup_path_spec.rb Added test cases for mixed-case scenarios

Test result

All 85 related tests pass:

  • 24 tests in lookup_path_spec.rb (including 6 new case-insensitive tests)
  • 17 tests in virtual_host_finder_spec.rb
  • 44 tests in url_builder_spec.rb

How to set up and validate locally

  • Start GDK services
  • gdk start
  • Create test project with mixed-case name via Rails console
  • Enable Pages and deploy
  • Access lowercase URL in browser
  • Verify authentication completes and page renders

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports