Merge remote-tracking branch 'origin/master' into fature/access-logging

Author: ndortega

src/extractors.jl

@@ -190,8 +190,8 @@ Extracts Headers from a request and convert it into a custom struct
 """
 function extract(param::Param{Header{T}}, request::LazyRequest) :: Header{T}  where {T}
     headers = Types.headers(request)
-    instance = safe_extract(param) do 
-        struct_builder(T, headers) 
+    instance = safe_extract(param) do
+        struct_builder(T, headers; casesensitive=false)
     end
     valid_instance = try_validate(param, instance)
     return Header(valid_instance)

src/middleware/extract_ip.jl

@@ -48,18 +48,21 @@ function extract_ip(req::HTTP.Request) :: IPAddr
     xff :: Union{String,Nothing} = nothing
     xri :: Union{String,Nothing} = nothing
 
+    # HTTP header names are case-insensitive, and HTTP.jl canonicalizes them to
+    # Title-Case (e.g. X-Real-IP -> X-Real-Ip), so match on the lowercased name.
     for (k, v) in req.headers
+        key = lowercase(k)
         # Case 1: Cloudflare's direct client IP header (return early since it's priority 1)
-        if k == "CF-Connecting-IP"
+        if key == "cf-connecting-ip"
             return parse(IPAddr, v)
         # Case 2: Akamai/Enterprise proxies (True-Client-IP)
-        elseif isnothing(tci) && k == "True-Client-IP"
+        elseif isnothing(tci) && key == "true-client-ip"
             tci = v
         # Case 3: Standard X-Forwarded-For header (may be a list)
-        elseif isnothing(xff) && k == "X-Forwarded-For"
+        elseif isnothing(xff) && key == "x-forwarded-for"
             xff = v
         # Case 4: Nginx or other proxies (X-Real-IP)
-        elseif isnothing(xri) && k == "X-Real-IP"
+        elseif isnothing(xri) && key == "x-real-ip"
             xri = v
         end
     end

src/middleware/rate_limiter.jl

@@ -361,18 +361,21 @@ function set_rate_headers!(resp::HTTP.Response, rate_limit::Int, remaining_reque
     has_reset = false
     has_retry = false
 
-    # Loop over the headers once and try to find each header
+    # Loop over the headers once and try to find each header. HTTP header names
+    # are case-insensitive, and HTTP.jl canonicalizes them on write (e.g.
+    # X-RateLimit-Limit -> X-Ratelimit-Limit), so match on the lowercased name.
     for (k, _) in resp.headers
+        key = lowercase(k)
         # End if all headers are found
         if has_retry && has_limit && has_remaining && has_reset
             break
-        elseif !has_retry && k == "Retry-After"
+        elseif !has_retry && key == "retry-after"
             has_retry = true
-        elseif !has_limit && k == "X-RateLimit-Limit"
+        elseif !has_limit && key == "x-ratelimit-limit"
             has_limit = true
-        elseif !has_remaining && k == "X-RateLimit-Remaining"
+        elseif !has_remaining && key == "x-ratelimit-remaining"
             has_remaining = true
-        elseif !has_reset && k == "X-RateLimit-Reset"
+        elseif !has_reset && key == "x-ratelimit-reset"
             has_reset = true
         end
     end

src/reflection.jl

@@ -426,14 +426,39 @@ function parsetype(target_type::Type{T}, value::Any) :: T where {T}
     end
 end
 
+"""
+    match_field_names(::Type{T}, params::AbstractDict{Symbol}) where {T}
+
+Return a copy of `params` whose keys are rewritten to the field names of `T`
+matched case-insensitively. Used for sources like HTTP headers, whose names are
+case-insensitive (and which HTTP.jl canonicalizes to Title-Case), so that a
+struct field `name` still matches an incoming `Name` header.
+"""
+function match_field_names(::Type{T}, params::AbstractDict{Symbol}) where {T}
+    lookup = Dict(lowercase(String(k)) => v for (k, v) in params)
+    matched = empty(params)
+    for name in fieldnames(T)
+        value = get(lookup, lowercase(String(name)), nothing)
+        if !isnothing(value)
+            matched[name] = value
+        end
+    end
+    return matched
+end
+
 """
     struct_builder(::Type{T}, parameters::Dict{String,String}) where {T}
 
 Constructs an object of type `T` using the parameters in the dictionary `parameters`.
+When `casesensitive` is false, parameter names are matched to the struct's field
+names ignoring case (used for case-insensitive sources like HTTP headers).
 """
-function struct_builder(::Type{T}, params::AbstractDict) :: T where {T}
+function struct_builder(::Type{T}, params::AbstractDict; casesensitive::Bool=true) :: T where {T}
     has_kwdef = has_kwdef_constructor(T)
-    params_with_symbols = Dict(Symbol(k) => v for (k, v) in params)   
+    params_with_symbols = Dict(Symbol(k) => v for (k, v) in params)
+    if !casesensitive
+        params_with_symbols = match_field_names(T, params_with_symbols)
+    end
     if has_kwdef
         # case 1: Use slower converter to handle structs with default values
         return kwarg_struct_builder(T, params_with_symbols)