v0.36.6

src/proxy/forward_entry.rs

@@ -139,8 +139,21 @@ async fn forward_request(
     }
     let websocket_legacy_support =
         handshake.is_some() && frontend.is_some_and(|frontend| frontend.websocket_legacy_support);
-    let redirect = snapshot.redirect_on(&host, &path, local.0, tls);
-    let local_host = snapshot.not_found_host_on(&host, local.0, tls);
+    // The most specific host name wins: an exact vhost such as autodiscover.example.com must not be
+    // shadowed by a wildcard redirect or 404 host (*.example.com) that happens to be evaluated first.
+    let frontend_rank = frontend.and_then(|_| snapshot.frontend_rank(&host, local.0, tls));
+    let redirect = snapshot
+        .redirect_on(&host, &path, local.0, tls)
+        .filter(|_| match (frontend_rank, snapshot.redirect_rank(&host, &path, local.0, tls)) {
+            (Some(vhost), Some(redirect)) => redirect >= vhost,
+            _ => true,
+        });
+    let local_host = snapshot
+        .not_found_host_on(&host, local.0, tls)
+        .filter(|_| match (frontend_rank, snapshot.not_found_rank(&host, local.0, tls)) {
+            (Some(vhost), Some(local_host)) => local_host >= vhost,
+            _ => true,
+        });
     if request.version() == Version::HTTP_2
         && (frontend.is_some_and(|frontend| !frontend.http2_enabled)
             || redirect.is_some_and(|(redirect, _)| !redirect.http2_enabled)