caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)

Matt Holt committed Feb 28, 2026 at 22:03 UTC 174fa2ddb93f830370b05058d1ea51ad1512597d

1 file changed +10 -1

modules/caddyhttp/replacer.go

+10 -1

@@ -420,7 +420,16 @@ func getReqTLSReplacement(req *http.Request, key string) (any, bool) {

420 if strings.HasPrefix(field, "client.") {

421 cert := getTLSPeerCert(req.TLS)

422 if cert == nil {

423 - return nil, false

423 + // Instead of returning (nil, false) here, we set it to a dummy

424 + // value to fix #7530. This way, even if there is no client cert,

425 + // evaluating placeholders with ReplaceKnown() will still remove

426 + // the placeholder, which would be expected. It is not expected

427 + // for the placeholder to sometimes get removed based on whether

428 + // the client presented a cert. We also do not return true here

429 + // because we probably should remain accurate about whether a

430 + // placeholder is, in fact, known or not.

431 + // (This allocation may be slightly inefficient.)

432 + cert = new(x509.Certificate)

433 }

434

435 // subject alternate names (SANs)