From 07a558024dd96bf483d0d7a1c04d8e9e40025b2b Mon Sep 17 00:00:00 2001
From: Harshavardhana <harsha@minio.io>
Date: Sun, 22 Mar 2026 17:38:18 -0700
Subject: [PATCH] fix: prefer exact key name match over canonical header form
 in condition lookup

getValuesByKey() currently tries http.CanonicalHeaderKey(name) before
the raw name. Reverse the order so that exact name matches take
precedence, falling back to canonical header form only when needed.
---
 policy/condition/value.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/policy/condition/value.go b/policy/condition/value.go
index 95fde52..d292931 100644
--- a/policy/condition/value.go
+++ b/policy/condition/value.go
@@ -28,10 +28,10 @@ import (
 
 func getValuesByKey(m map[string][]string, key Key) []string {
 	name := key.Name()
-	if values, found := m[http.CanonicalHeaderKey(name)]; found {
+	if values, found := m[name]; found {
 		return values
 	}
-	return m[name]
+	return m[http.CanonicalHeaderKey(name)]
 }
 
 // Splits an incoming path into bucket and object components.