Case mismatch in `SCRIPT_NAME` on IIS with Rewrite module

Description

I'm encountering a strange behavior on IIS regarding the $_SERVER['SCRIPT_NAME'] variable.

On a Windows 11 machine, I have an IIS running with PHP via FastCGI. I've configured a virtual directory named routingtest. in that directory, I have an index.php file that just dumps the script name and the request URI.

<?php

var_dump($_SERVER['SCRIPT_NAME']);
var_dump($_SERVER['REQUEST_URI']);

So, if I point my browser to http://localhost/routingtest/index.php/foo/bar, I see the expected output:

string(22) "/routingtest/index.php"
string(30) "/routingtest/index.php/foo/bar"

Since directory and file names are case-insensitive in Windows and IIS, I can reach the same script as http://localhost/RoutingTest/index.php/foo/bar and the two variables reflect the different case:

string(22) "/RoutingTest/index.php"
string(30) "/RoutingTest/index.php/foo/bar"

That's still as it should be. Now, I add a rewrite rule because I want to get rid of the index.php in my URLs:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="FrontController">
                    <match url=".*" />
                    <conditions trackAllCaptures="true">
                        <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                    </conditions>
                    <action type="Rewrite" url="index.php/{R:0}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

Calling http://localhost/routingtest/foo/bar:

string(22) "/routingtest/index.php"
string(20) "/routingtest/foo/bar"

Looks correct. Calling http://localhost/RoutingTest/foo/bar:

string(22) "/routingtest/index.php"
string(20) "/RoutingTest/foo/bar"

Note how SCRIPT_NAME still contains the value from the first request while REQUEST_URI is updated correctly. If I restart the IIS and make the two requests in reverse order, I get:

http://localhost/RoutingTest/foo/bar:

string(22) "/RoutingTest/index.php"
string(20) "/RoutingTest/foo/bar"

http://localhost/routingtest/foo/bar:

string(22) "/RoutingTest/index.php"
string(20) "/routingtest/foo/bar"

This means the first request after the IIS has started controls how SCRIPT_NAME is reported for all subsequent requests until the server is restarted again. This behavior confuses e.g. Symfony's HttpFoundation which uses SCRIPT_NAME and REQUEST_URI to determine the base path to the front controller script.

I don't really know if this is a bug in PHP or if this has to be fixed in IIS or the rewrite module. If I have to take this somewhere else, please point me into that direction.

PHP Version

8.1.22

Operating System

Windows 11

Beginne damit, die Sequenz mit index.php und der IIS Rewrite-Konfiguration unter Windows 11 mit PHP 8.1.22 über FastCGI zu reproduzieren. Vergleiche SCRIPT_NAME und REQUEST_URI bei Anfragen mit unterschiedlicher Groß-/Kleinschreibung und ermittle anschließend, ob das Verhalten von PHP oder IIS/Rewrite ausgeht. Als erledigt gilt die Identifizierung der verantwortlichen Komponente sowie die Dokumentation oder Implementierung einer geeigneten Lösung.