From e8d288a300276f4ee32812ddaff5f3c3ead1293d Mon Sep 17 00:00:00 2001
From: Eric Covener <covener@apache.org>
Date: Thu, 3 Sep 2026 12:30:06 +0000
Subject: [PATCH] Merge r1937809 from trunk:

add a warning to elaborate on string-matching



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1937810 13f79535-47bb-0310-9956-ffa450edef68
---
 docs/manual/mod/mod_proxy.xml | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/docs/manual/mod/mod_proxy.xml b/docs/manual/mod/mod_proxy.xml
index afd6d99c61..b3ee2536f8 100644
--- a/docs/manual/mod/mod_proxy.xml
+++ b/docs/manual/mod/mod_proxy.xml
@@ -505,8 +505,9 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10
 
 <usage>
     <p>Directives placed in <directive type="section">Proxy</directive>
-    sections apply only to matching proxied content using a simple string prefix match against the URL.  Shell-style wildcards are also
-    allowed.</p>
+       sections apply only to matching proxied content using a simple string
+       prefix match against the URL.  Shell-style wildcards are also allowed.
+    </p>
 
     <p>For example, the following will allow only hosts in
     <code>yournetwork.example.com</code> to access content via your proxy
@@ -528,6 +529,14 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10
 &lt;/Proxy&gt;
     </highlight>
 
+   <note type="warning"><title>Warning</title>
+   This configuration section does not canonicalize any part of the string
+   being matched such as schemes, hostnames, IP addresses, etc.  Care should be
+   taken if using it for access control, including but not limited to
+   denying access by default and allowing expected hostnames rather than the
+   inverse where a denial could be bypassed by using alternate forms.
+    </note>
+
     <note><title>Differences from the Location configuration section</title>
       <p>A backend URL matches the configuration section if it begins with the
       the <var>wildcard-url</var> string, even if the last path segment in the
@@ -591,6 +600,14 @@ proxied resources</description>
     type="section">Proxy</directive> directive, except that it matches URLs
     using <glossary ref="regex">regular expressions</glossary>.</p>
 
+   <note type="warning"><title>Warning</title>
+   This configuration section does not canonicalize any part of the string
+   being matched such as schemes, hostnames, IP addresses, etc.  Care should be
+   taken if using it for access control, including but not limited to
+   denying access by default and allowing expected hostnames rather than the
+   inverse where a denial could be bypassed by using alternate forms.
+   </note>
+
     <p>From 2.4.8 onwards, named groups and backreferences are captured and
     written to the environment with the corresponding name prefixed with
     "MATCH_" and in upper case. This allows elements of URLs to be referenced