[RaphaelFakhri]

Summary

matchHostPattern compared the request host with the service host pattern byte for byte. DNS names are case-insensitive (RFC 4343), so a request to API.Stripe.com missed a service configured for api.stripe.com. The request then got no credential injection and fell through to the unmatched-host policy. The reverse also failed: ValidateHost accepts uppercase letters, so a service saved as API.Stripe.com never matched clients that lowercase the host, such as Node.js and Python urllib3.

This change lowercases both the pattern and the host before comparing them. The fix covers exact and *. wildcard patterns, and AnyHostMatches, which uses the same helper.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• CI / build

Test plan

• Existing tests pass (make test)
• Added/updated tests for new behavior
• Manual testing (describe below)

TestMatchServiceHostCaseInsensitive covers mixed-case hosts against an exact pattern and a mixed-case wildcard pattern, and checks AnyHostMatches. It fails without the fix (host "API.Stripe.COM": expected stripe, got <nil>) and passes with it. go test ./internal/broker/ ./internal/proposal/, go vet ./internal/broker/ and gofmt -l are clean.

Security checklist

• No secrets or credentials in code
• No new unauthenticated endpoints
• Input validation on new API surfaces
• Checked for OWASP top 10 (injection, XSS, etc.)

Fixes #460

[infisical-cla-app]

✅ CLA satisfied. All contributors have signed the current CLA. The cla/signed check is passing.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the earlier credential-leak finding is fixed and no new actionable issues were found.

Summary

Makes service hosts match regardless of ASCII letter case.

• Broker services match hostnames even when their letter case differs.

_{Reviews (2) · Last reviewed commit: "fix(broker): fold only ASCII letters whe..." · Reviewed by Greptile}