v2.33.2 — a name in the wrong case

v2.33.2

One fix: a rate limit keyed on a field with a capital in its name counted a field that was never there, and ended up limiting every visitor as one.

PHP 8.1–8.5 supported. No new configuration keys, and no configuration changes are required.

What changes on upgrade

• A rate-limit key: naming a capitalised post, cookie or query field starts counting per value. Its old shared counter is dropped once, at upgrade. Before, it was one counter for everybody.
• Nothing else moves. Every key that already worked, including a header written as header.User-Agent and a prefix written as POST., maps to exactly the counter it did before, so no other limit resets. A test fixes both stored keys so this can't change unnoticed.

Fixed

• RateLimit lower-cased post, cookie and query key names, so they never resolved (#412, #413). keyComponents() lower-cased every component. That's harmless for headers, which HTTP makes case-insensitive, but POST, cookie and query names are case-sensitive everywhere that reads them. So post.userName read username, found nothing, and resolved to the empty string, the documented value for an absent field, for every request.

  Every request then shared one counter. The limit looked like it was working unusually well until it tripped, and then it refused everybody on that path at once. Per-account protection against credential stuffing, which is what an account key is for, was missing. A limit of 2, three different accounts, one attempt each, from three addresses:

  Key	Before	After
  post.username	ok, ok, ok	ok, ok, ok
  post.userName	ok, ok, refused	ok, ok, ok

  The prefix and header names are still case-insensitive; field names under post, cookie and query now keep their case. Rate limit → what a limit counts by now says so.

Found from a downstream report against drupal/basic_firewall, whose form refuses capitalised names for now and stores the case as typed, so its keys are already right on this upgrade.

Full changelog: v2.33.1...v2.33.2