What is the difference between an Exact Path and a glob path?

Short answer

An Exact Path (/login) is compared with the path of the request exactly; a glob path (/api/v*/login) is a pattern and covers all the paths that match the pattern (what Add is). Which one is created is determined by the value written in the Path field: if the value has a wildcard such as *, ?, [ ], { }, the rule becomes glob on its own and the form switches to glob mode (the test table and, while Structure Checks is on, the Path Length and Path Depth fields appear); there is no separate type selector in the form. In the matching, the exact rule always comes first; if there is no exact rule, all the glob rules that match the path are applied together; if none of them matches, Any Paths is applied (runtime rule matching). Both are case-sensitive and do not take the query string into account, and the trailing / character of the request is dropped before the matching.

How Does It Work?

1. While the rule is being saved, the Path value is examined; a value that contains no wildcard is marked as an exact rule, and a value that contains a wildcard is marked as a glob rule.
2. When a request arrives, its path is first compared exactly with the exact rules; if there is a matching exact rule, the glob rules complete only the Check fields sections that it does not define.
3. If there is no exact match, all the glob rules that match the path are combined in the order of definition, and Any paths is added at the end (If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?).

Comparison

	Exact	Glob
Example	/login, /api/users	/api/v*/login, /files/**, /img/*.{png,jpg}
Matching	Exact	All the paths that match the pattern
Priority	Exact first; if it matches, the path settings come from it	If there is no exact rule, the matching globs together; the path settings come from the first matching glob
Path length · Path depth	Not shown in the form (the path is fixed)	Present (What are the Path Length and Path Depth constraints for?)
Test table	None	The Input / Result table (How are glob patterns (*, **) written; how is the path test tool used?)
In the list	At the very top, in alphabetical order	Below the exact rules, in the order of adding; the row and the path with the highlight color
In the same group	A second rule with the same path cannot be added (Rule collision)	A second rule with the same pattern cannot be added; a /a exact rule and a /a/* glob rule can exist together

• Trailing /: the trailing / character of the request path is dropped before the matching; an exact rule written as /api/login/ does not match the /api/login/ request (the request is compared as /api/login) (Path).
• To switch between exact and glob, the Path value is changed in the Edit form of the rule; the Check fields inspections are kept.
• The * in host patterns is a different mechanism (Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?).

Common Misconceptions

• "Since glob is more comprehensive, it overrides exact." If there is an exact rule, the path settings come from the exact rule; glob only completes the Check fields sections that the exact rule does not define.
• "The type is selected from the form." The type is inferred from whether the written value contains a wildcard or not.
• "The rule at the top of the list is applied first." The priority between exact, glob and Any paths comes from the type of the rule; the order of definition matters only between multiple glob rules (the path settings come from the matching glob rule that was defined first).

How it is done in the documentation

• Add · What Is Add?
• Add · Path
• Add · Glob Path
• WAF Rules · Runtime: Rule Matching

Related questions

• How are glob patterns (*, **) written; how is the path test tool used?
• If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?
• Can I use wildcards (*.example.com) in the Virtual Host Patterns field, or is an exact match required?