[php-src] Issue #11981: Case mismatch in `SCRIPT_NAME` on IIS with Rewrite module

From:	derrabus	Date:	Tue, 15 Aug 2023 15:22:48 +0000
Subject:	[php-src] Issue #11981: Case mismatch in `SCRIPT_NAME` on IIS with Rewrite module
Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-245190@lists.php.net to get a copy of this message

Issue: https://github.com/php/php-src/issues/11981 Author: derrabus ### Description I'm encountering a strange behavior on IIS regarding the $_SERVER['SCRIPT_NAME'] variable. On a Windows 11 machine, I have an IIS running with PHP via FastCGI. I've configured a virtual directory named routingtest. in that directory, I have an index.php file that just dumps the script name and the request URI. ```php <?php var_dump($_SERVER['SCRIPT_NAME']); var_dump($_SERVER['REQUEST_URI']); ``` So, if I point my browser to

http://localhost/routingtest/index.php/foo/bar`,
I see the expected output:

```
string(22) "/routingtest/index.php"
string(30) "/routingtest/index.php/foo/bar"
```

Since directory and file names are case-insensitive in Windows and IIS, I can reach the same script
as http://localhost/RoutingTest/index.php/foo/bar`
and the two variables reflect the different case:

```
string(22) "/RoutingTest/index.php"
string(30) "/RoutingTest/index.php/foo/bar"
```

That's still as it should be. Now, I add a rewrite rule because I want to get rid of the
index.php in my URLs:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="FrontController">
                    <match url=".*" />
                    <conditions trackAllCaptures="true">
                        <add input="{REQUEST_FILENAME}" matchType="IsFile"
negate="true" />
                        <add input="{REQUEST_FILENAME}"
matchType="IsDirectory" negate="true" />
                    </conditions>
                    <action type="Rewrite" url="index.php/{R:0}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>
```

Calling http://localhost/routingtest/foo/bar`:

```
string(22) "/routingtest/index.php"
string(20) "/routingtest/foo/bar"
```

Looks correct. Calling http://localhost/RoutingTest/foo/bar`:

```
string(22) "/routingtest/index.php"
string(20) "/RoutingTest/foo/bar"
```

Note how SCRIPT_NAME still contains the value from the first request while
REQUEST_URI is updated correctly. If I restart the IIS and make the two requests in
reverse order, I get:

http://localhost/RoutingTest/foo/bar`:

```
string(22) "/RoutingTest/index.php"
string(20) "/RoutingTest/foo/bar"
```

http://localhost/routingtest/foo/bar`:

```
string(22) "/RoutingTest/index.php"
string(20) "/routingtest/foo/bar"
```

This means the first request after the IIS has started controls how SCRIPT_NAME is
reported for all subsequent requests until the server is restarted again. This behavior confuses
e.g. Symfony's HttpFoundation which uses SCRIPT_NAME and REQUEST_URI
to determine the base path to the front controller script.

I don't really know if this is a bug in PHP or if this has to be fixed in IIS or the rewrite
module. If I have to take this somewhere else, please point me into that direction.

### PHP Version

8.1.22

### Operating System

Windows 11