fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)

Oleh Konko | semantic verification for trust infra | LLM-augmented operations pipeline (precision-first, claim≤evidence, submit-human) | verify the payload, not the signer committed Mar 4, 2026 at 23:00 UTC 566e710991a6b752933178e2c6126181efc563aa

1 file changed +5

modules/caddyhttp/fileserver/staticfiles.go

@@ -125,6 +125,11 @@ type FileServer struct {

125 // When possible, all paths are resolved to their absolute form before

126 // comparisons are made. For maximum clarity and explictness, use complete,

127 // absolute paths; or, for greater portability, use relative paths instead.

128 + //

129 + // Note that hide comparisons are case-sensitive. On case-insensitive

130 + // filesystems, requests with different path casing may still resolve to the

131 + // same file or directory on disk, so hide should not be treated as a

132 + // security boundary for sensitive paths.

133 Hide []string `json:"hide,omitempty"`

134

135 // The names of files to try as index files if a folder is requested.