WEB: Base Path: security + reload coverage fixes&tests

src/config/load/runtime_web/tests.rs

@@ -38,6 +38,23 @@ fn capability_matches_reference_vectors() {
     }
 }
 
+#[test]
+fn capability_binds_the_exact_host_and_base_path_identity() {
+    let secret = hex::decode("000102030405060708090a0b0c0d0e0f").unwrap();
+    let root = derive_web_capability(&secret, b"proxy.example.com", b"").unwrap();
+    let mixed = derive_web_capability(&secret, b"proxy.example.com", b"MixedCase/path").unwrap();
+    let lower = derive_web_capability(&secret, b"proxy.example.com", b"mixedcase/path").unwrap();
+    let other_path =
+        derive_web_capability(&secret, b"proxy.example.com", b"MixedCase/other").unwrap();
+    let other_host =
+        derive_web_capability(&secret, b"other.example.com", b"MixedCase/path").unwrap();
+
+    let identities = [root, mixed, lower, other_path, other_host]
+        .into_iter()
+        .collect::<std::collections::HashSet<_>>();
+    assert_eq!(identities.len(), 5);
+}
+
 #[cfg(unix)]
 #[test]
 fn static_snapshot_remains_anchored_after_root_path_replacement() {

src/config/load/strict_keys.rs

@@ -365,13 +365,7 @@ const WEB_TIMEOUTS_CONFIG_KEYS: &[&str] = &[
     "decoy_header_secs",
 ];
 
-const WEB_VHOST_CONFIG_KEYS: &[&str] = &[
-    "host",
-    "base_path",
-    "public_addr",
-    "decoy",
-    "profiles",
-];
+const WEB_VHOST_CONFIG_KEYS: &[&str] = &["host", "base_path", "public_addr", "decoy", "profiles"];
 const WEB_DECOY_CONFIG_KEYS: &[&str] = &["mode", "upstream", "directory", "index"];
 const WEB_PROFILE_CONFIG_KEYS: &[&str] = &[
     "user",

src/config/load/validate_web/vhosts.rs

@@ -85,7 +85,9 @@ fn validate_web_base_path(value: &str, field: &str) -> Result<()> {
         && !value.ends_with('/')
         && value.split('/').all(|segment| {
             let mut bytes = segment.bytes();
-            bytes.next().is_some_and(|byte| byte.is_ascii_alphanumeric())
+            bytes
+                .next()
+                .is_some_and(|byte| byte.is_ascii_alphanumeric())
                 && bytes.all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
         });
     if value.is_empty() || valid {