Rules not matching specific path #1620

New Issue

MrUnknownDE · 2026-04-05T19:37:35+02:00

MrUnknownDE commented

2026-04-05 19:37:35 +02:00

Originally created by @scetu on 4/10/2025

Path rule is incorrectly matching path for /livekit-jwt-service/sfu/get, in Debug logs it is vissible that it get's matched by rule /livekit* or *livekit* but Final result for this rules is False and goes down to the catch-all rule Deny all *

2025-04-10T05:31:10.046Z [debug]: Verify session: Badger sent {<redacted>,"path":"/livekit-jwt-service/sfu/get","method":"GET",<redacted>}}
2025-04-10T05:31:10.047Z [debug]: 
Matching path "/livekit-jwt-service/sfu/get" against pattern "/livekit*"
2025-04-10T05:31:10.048Z [debug]: Normalized pattern parts: [livekit*]
2025-04-10T05:31:10.048Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get]
2025-04-10T05:31:10.048Z [debug]: Checking patternIndex=0 (livekit*) vs pathIndex=0 (livekit-jwt-service)
2025-04-10T05:31:10.048Z [debug]: Found in-segment wildcard in "livekit*"
2025-04-10T05:31:10.048Z [debug]: Segment with wildcard matches: "livekit*" matches "livekit-jwt-service"
2025-04-10T05:31:10.049Z [debug]:   Checking patternIndex=1 (END) vs pathIndex=1 (sfu)
2025-04-10T05:31:10.049Z [debug]:   Reached end of pattern, remaining path: sfu/get -> false
2025-04-10T05:31:10.049Z [debug]: Final result: false
2025-04-10T05:31:10.049Z [debug]: 
Matching path "/livekit-jwt-service/sfu/get" against pattern "livekit"
2025-04-10T05:31:10.049Z [debug]: Normalized pattern parts: [livekit]
2025-04-10T05:31:10.049Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get]
2025-04-10T05:31:10.049Z [debug]: Checking patternIndex=0 (livekit) vs pathIndex=0 (livekit-jwt-service)
2025-04-10T05:31:10.049Z [debug]: Segment mismatch: "livekit" != "livekit-jwt-service"
2025-04-10T05:31:10.049Z [debug]: Final result: false
2025-04-10T05:31:10.049Z [debug]: 
Matching path "/livekit-jwt-service/sfu/get" against pattern "*livekit*"
2025-04-10T05:31:10.049Z [debug]: Normalized pattern parts: [*livekit*]
2025-04-10T05:31:10.049Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get]
2025-04-10T05:31:10.049Z [debug]: Checking patternIndex=0 (*livekit*) vs pathIndex=0 (livekit-jwt-service)
2025-04-10T05:31:10.049Z [debug]: Found in-segment wildcard in "*livekit*"
2025-04-10T05:31:10.049Z [debug]: Segment with wildcard matches: "*livekit*" matches "livekit-jwt-service"
2025-04-10T05:31:10.049Z [debug]:   Checking patternIndex=1 (END) vs pathIndex=1 (sfu)
2025-04-10T05:31:10.049Z [debug]:   Reached end of pattern, remaining path: sfu/get -> false
2025-04-10T05:31:10.049Z [debug]: Final result: false
2025-04-10T05:31:10.049Z [debug]: 
Matching path "/livekit-jwt-service/sfu/get" against pattern "*"
2025-04-10T05:31:10.050Z [debug]: Normalized pattern parts: [*]
2025-04-10T05:31:10.050Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get]
2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=0 (*) vs pathIndex=0 (livekit-jwt-service)
2025-04-10T05:31:10.050Z [debug]: Found wildcard at pattern index 0
2025-04-10T05:31:10.050Z [debug]: Trying to skip wildcard (consume 0 segments)
2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=1 (END) vs pathIndex=0 (livekit-jwt-service)
2025-04-10T05:31:10.050Z [debug]: Reached end of pattern, remaining path: livekit-jwt-service/sfu/get -> false
2025-04-10T05:31:10.050Z [debug]: Trying to consume segment "livekit-jwt-service" for wildcard
2025-04-10T05:31:10.050Z [debug]:   Checking patternIndex=0 (*) vs pathIndex=1 (sfu)
2025-04-10T05:31:10.050Z [debug]:   Found wildcard at pattern index 0
2025-04-10T05:31:10.050Z [debug]:   Trying to skip wildcard (consume 0 segments)
2025-04-10T05:31:10.050Z [debug]:   Checking patternIndex=1 (END) vs pathIndex=1 (sfu)
2025-04-10T05:31:10.050Z [debug]:   Reached end of pattern, remaining path: sfu/get -> false
2025-04-10T05:31:10.050Z [debug]:   Trying to consume segment "sfu" for wildcard
2025-04-10T05:31:10.050Z [debug]:     Checking patternIndex=0 (*) vs pathIndex=2 (get)
2025-04-10T05:31:10.050Z [debug]:     Found wildcard at pattern index 0
2025-04-10T05:31:10.050Z [debug]:     Trying to skip wildcard (consume 0 segments)
2025-04-10T05:31:10.050Z [debug]:     Checking patternIndex=1 (END) vs pathIndex=2 (get)
2025-04-10T05:31:10.050Z [debug]:     Reached end of pattern, remaining path: get -> false
2025-04-10T05:31:10.050Z [debug]:     Trying to consume segment "get" for wildcard
2025-04-10T05:31:10.050Z [debug]:       Checking patternIndex=0 (*) vs pathIndex=3 (END)
2025-04-10T05:31:10.050Z [debug]:       Reached end of path, remaining pattern: * -> true
2025-04-10T05:31:10.050Z [debug]:     Successfully matched by consuming segment for wildcard
2025-04-10T05:31:10.051Z [debug]:   Successfully matched by consuming segment for wildcard
2025-04-10T05:31:10.051Z [debug]: Successfully matched by consuming segment for wildcard
2025-04-10T05:31:10.051Z [debug]: Final result: true
2025-04-10T05:31:10.051Z [debug]: Resource denied by rule
2025-04-10T05:31:10.051Z [debug]: {"data":{"valid":false},"success":true,"error":false,"message":"Access denied","status":200}

I have also other rules for this resource, and they are evauluated correctly, but only this path /livekit-jwt-service/sfu/get is incorrectly evaluated.

*Originally created by @scetu on 4/10/2025* Path rule is incorrectly matching path for `/livekit-jwt-service/sfu/get`, in Debug logs it is vissible that it get's matched by rule `/livekit*` or `*livekit*` but Final result for this rules is `False` and goes down to the catch-all rule `Deny all *` ``` 2025-04-10T05:31:10.046Z [debug]: Verify session: Badger sent {<redacted>,"path":"/livekit-jwt-service/sfu/get","method":"GET",<redacted>}} 2025-04-10T05:31:10.047Z [debug]: Matching path "/livekit-jwt-service/sfu/get" against pattern "/livekit*" 2025-04-10T05:31:10.048Z [debug]: Normalized pattern parts: [livekit*] 2025-04-10T05:31:10.048Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get] 2025-04-10T05:31:10.048Z [debug]: Checking patternIndex=0 (livekit*) vs pathIndex=0 (livekit-jwt-service) 2025-04-10T05:31:10.048Z [debug]: Found in-segment wildcard in "livekit*" 2025-04-10T05:31:10.048Z [debug]: Segment with wildcard matches: "livekit*" matches "livekit-jwt-service" 2025-04-10T05:31:10.049Z [debug]: Checking patternIndex=1 (END) vs pathIndex=1 (sfu) 2025-04-10T05:31:10.049Z [debug]: Reached end of pattern, remaining path: sfu/get -> false 2025-04-10T05:31:10.049Z [debug]: Final result: false 2025-04-10T05:31:10.049Z [debug]: Matching path "/livekit-jwt-service/sfu/get" against pattern "livekit" 2025-04-10T05:31:10.049Z [debug]: Normalized pattern parts: [livekit] 2025-04-10T05:31:10.049Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get] 2025-04-10T05:31:10.049Z [debug]: Checking patternIndex=0 (livekit) vs pathIndex=0 (livekit-jwt-service) 2025-04-10T05:31:10.049Z [debug]: Segment mismatch: "livekit" != "livekit-jwt-service" 2025-04-10T05:31:10.049Z [debug]: Final result: false 2025-04-10T05:31:10.049Z [debug]: Matching path "/livekit-jwt-service/sfu/get" against pattern "*livekit*" 2025-04-10T05:31:10.049Z [debug]: Normalized pattern parts: [*livekit*] 2025-04-10T05:31:10.049Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get] 2025-04-10T05:31:10.049Z [debug]: Checking patternIndex=0 (*livekit*) vs pathIndex=0 (livekit-jwt-service) 2025-04-10T05:31:10.049Z [debug]: Found in-segment wildcard in "*livekit*" 2025-04-10T05:31:10.049Z [debug]: Segment with wildcard matches: "*livekit*" matches "livekit-jwt-service" 2025-04-10T05:31:10.049Z [debug]: Checking patternIndex=1 (END) vs pathIndex=1 (sfu) 2025-04-10T05:31:10.049Z [debug]: Reached end of pattern, remaining path: sfu/get -> false 2025-04-10T05:31:10.049Z [debug]: Final result: false 2025-04-10T05:31:10.049Z [debug]: Matching path "/livekit-jwt-service/sfu/get" against pattern "*" 2025-04-10T05:31:10.050Z [debug]: Normalized pattern parts: [*] 2025-04-10T05:31:10.050Z [debug]: Normalized path parts: [livekit-jwt-service, sfu, get] 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=0 (*) vs pathIndex=0 (livekit-jwt-service) 2025-04-10T05:31:10.050Z [debug]: Found wildcard at pattern index 0 2025-04-10T05:31:10.050Z [debug]: Trying to skip wildcard (consume 0 segments) 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=1 (END) vs pathIndex=0 (livekit-jwt-service) 2025-04-10T05:31:10.050Z [debug]: Reached end of pattern, remaining path: livekit-jwt-service/sfu/get -> false 2025-04-10T05:31:10.050Z [debug]: Trying to consume segment "livekit-jwt-service" for wildcard 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=0 (*) vs pathIndex=1 (sfu) 2025-04-10T05:31:10.050Z [debug]: Found wildcard at pattern index 0 2025-04-10T05:31:10.050Z [debug]: Trying to skip wildcard (consume 0 segments) 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=1 (END) vs pathIndex=1 (sfu) 2025-04-10T05:31:10.050Z [debug]: Reached end of pattern, remaining path: sfu/get -> false 2025-04-10T05:31:10.050Z [debug]: Trying to consume segment "sfu" for wildcard 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=0 (*) vs pathIndex=2 (get) 2025-04-10T05:31:10.050Z [debug]: Found wildcard at pattern index 0 2025-04-10T05:31:10.050Z [debug]: Trying to skip wildcard (consume 0 segments) 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=1 (END) vs pathIndex=2 (get) 2025-04-10T05:31:10.050Z [debug]: Reached end of pattern, remaining path: get -> false 2025-04-10T05:31:10.050Z [debug]: Trying to consume segment "get" for wildcard 2025-04-10T05:31:10.050Z [debug]: Checking patternIndex=0 (*) vs pathIndex=3 (END) 2025-04-10T05:31:10.050Z [debug]: Reached end of path, remaining pattern: * -> true 2025-04-10T05:31:10.050Z [debug]: Successfully matched by consuming segment for wildcard 2025-04-10T05:31:10.051Z [debug]: Successfully matched by consuming segment for wildcard 2025-04-10T05:31:10.051Z [debug]: Successfully matched by consuming segment for wildcard 2025-04-10T05:31:10.051Z [debug]: Final result: true 2025-04-10T05:31:10.051Z [debug]: Resource denied by rule 2025-04-10T05:31:10.051Z [debug]: {"data":{"valid":false},"success":true,"error":false,"message":"Access denied","status":200} ``` I have also other rules for this resource, and they are evauluated correctly, but only this path `/livekit-jwt-service/sfu/get` is incorrectly evaluated.

MrUnknownDE closed this issue

2026-04-05 19:37:35 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1620