PathPrefix bug

Author: zhj-hxCreated Apr 3, 2026Updated Apr 4, 2026

Labelsbug

Describe the bug

PathPrefix does not correctly allow connections even when the path exactly matches the configured prefix. Connections are rejected with a 400 status code,This only works if PathPrefix is configured as "^.*$", allowing all

To Reproduce

Steps to reproduce the behavior:

server config

restrictions:
  # dev
  - name: "dev-access"
    description: "dev user access only dev ssh"
    match:
      - !PathPrefix "^/apassword$"
      #- !Authorization "^Bearer dev-token$"
    allow:
      - !Tunnel
        protocol:
          - Tcp
        port:
          - 2222
        host: "^ssh-internal.test$"
        cidr:
          - 172.16.8.2/32

Start the server

RUST_LOG=trace ./wstunnel server ws://[::]:8088 --restrict-config restrict-config.yaml

Start a client

./wstunnel client -L tcp://0.0.0.0:2222:ssh-internal.test:2222  wss://c.test.com:8443/apassword

ssh -i test.id -p 2222 [email protected]
Connection closed by 172.17.1.5 port 2222

Observe the client logs:

2026-04-03T08:55:46.095305Z  INFO wstunnel::protocols::tcp::server: Opening TCP connection to c.test.com:8443
2026-04-03T08:55:46.097605Z  INFO wstunnel::protocols::tls::server: Doing TLS handshake using SNI DnsName("c.test.com") with the server c.test.com:8443
2026-04-03T08:55:46.099971Z ERROR tunnel{id="019d528e-3aaf-7120-8b99-374d0620ba76" remote="ssh-internal.test:2222"}: wstunnel::tunnel::client::client: failed to do websocket handshake with the server wss://c.test.com:8443

Caused by:
    Invalid status code: 400

Observe the server logs:

2026-04-03T08:54:40.869349Z TRACE mio::poll: registering event source with poller: token=Token(140593064968320), interests=READABLE | WRITABLE
2026-04-03T08:54:40.869421Z  INFO cnx{peer="[::ffff:127.0.0.1]:57358"}: wstunnel::tunnel::server::server: Accepting connection
2026-04-03T08:54:40.869999Z  WARN cnx{peer="[::ffff:127.0.0.1]:57358"}:tunnel{id="019d528d-3bbf-7a11-8bfe-ac0212fe6df7" remote="ssh-internal.test:2222"}: wstunnel::tunnel::server::server: Rejecting connection with not allowed destination: RemoteAddr { protocol: Tcp { proxy_protocol: false }, host: Domain("ssh-internal.test"), port: 2222 }
2026-04-03T08:54:40.870159Z TRACE cnx{peer="[::ffff:127.0.0.1]:57358"}: mio::poll: deregistering event source from poller

Expected behavior

PathPrefix works correctly.

Desktop (please complete the following information):

OS: Ubuntu 24.04 LTS
Version wstunnel v10.5.2

Additional context Add any other context about the problem here.

Source: erebe/wstunnel

View original on GitHub View discussion on GitHub