Weird issue with map-wp.conf and bypassing cache

I’m getting unwanted redis page caching of responses to WooCommerce API calls.

Digging into why that is, I have discovered two anomalies with map-wp.conf on my server where it sets the variables $uri_no_cache and $skip_cache.

1. in the map that sets the $uri_no_cache some regexes do not match requests that they should, while others work perfectly. I know how trecherous regexes can be and I am 99.999% certain that there isn’t a problem with the regex. Here is the map with everything taken out of it except for a couple patterns that illustrate:

map $request_uri $uri_no_cache {
default 0;
…
"~*/wc-api/" 1;
"~*/wp-json/wc/v3/" 1;
}

A request that looks like this: https://example.com/wp-json/wc/v3/products/308968 is not matching. But a request that looks like this: https://example.com/wc-api/products/308968 does match.

I have set up some more_set_headers directives that show all the relevant variables to see what’s happening. That looks like this:

# debug
more_set_headers 'X-Z_map $http_request_no_cache$http_auth_no_cache$cookie_no_cache$uri_no_cache$query_no_cache';
more_set_headers 'X-Z_skip-cache $skip_cache';
more_set_headers 'X-Z_request_uri_no_cache $uri_no_cache';
more_set_headers 'X-Z_auth_no_cache $http_auth_no_cache';
more_set_headers 'X-Z_request_uri $request_uri';

And the results in the browser dev tools for the two requests shown above look like so:

2. I only went down the rabbit hole above because I tried to implement not caching based on the request_uri because not caching based on the Authorization header - which should be protecting these API calls from being cached - is not working for me.

The two requests above in issue 1 are just with an unauthenticated browser (and neither actually returns anything other than an unauthorized message).

But when I do the request to https://example.com/wp-json/wc/v3/products/308968 with an authenticated Rest API client, the variable $http_auth_no_cache does get correctly set to 1 and the result in the map for $skip_cache looks correctly like 01000, but somehow $skip_cache is still 0 and the response from that request gets cached. Here’s what the debug headers look like in the REST client:

Something weird and invisible seems to be going on with requests that begin with /wp-json/.

The map that sets $skip_cache is default from wo:

# if all previous check are passed, $skip_cache = 0
map $http_request_no_cache$http_auth_no_cache$cookie_no_cache$uri_no_cache$query_no_cache $skip_cache {
default 1;
00000 0;
}

nginx -version: nginx version: nginx/1.24.0 (WordOps Nginx-wo)

How can I figure this out and fix it?

cc: @VirtuBox