Case mismatch in `SCRIPT_NAME` on IIS with Rewrite module

Description

I'm encountering a strange behavior on IIS regarding the $_SERVER['SCRIPT_NAME'] variable.

On a Windows 11 machine, I have an IIS running with PHP via FastCGI. I've configured a virtual directory named routingtest. in that directory, I have an index.php file that just dumps the script name and the request URI.

<?php

var_dump($_SERVER['SCRIPT_NAME']);
var_dump($_SERVER['REQUEST_URI']);

So, if I point my browser to http://localhost/routingtest/index.php/foo/bar, I see the expected output:

string(22) "/routingtest/index.php"
string(30) "/routingtest/index.php/foo/bar"

Since directory and file names are case-insensitive in Windows and IIS, I can reach the same script as http://localhost/RoutingTest/index.php/foo/bar and the two variables reflect the different case:

string(22) "/RoutingTest/index.php"
string(30) "/RoutingTest/index.php/foo/bar"

That's still as it should be. Now, I add a rewrite rule because I want to get rid of the index.php in my URLs:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="FrontController">
                    <match url=".*" />
                    <conditions trackAllCaptures="true">
                        <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                    </conditions>
                    <action type="Rewrite" url="index.php/{R:0}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

Calling http://localhost/routingtest/foo/bar:

string(22) "/routingtest/index.php"
string(20) "/routingtest/foo/bar"

Looks correct. Calling http://localhost/RoutingTest/foo/bar:

string(22) "/routingtest/index.php"
string(20) "/RoutingTest/foo/bar"

Note how SCRIPT_NAME still contains the value from the first request while REQUEST_URI is updated correctly. If I restart the IIS and make the two requests in reverse order, I get:

http://localhost/RoutingTest/foo/bar:

string(22) "/RoutingTest/index.php"
string(20) "/RoutingTest/foo/bar"

http://localhost/routingtest/foo/bar:

string(22) "/RoutingTest/index.php"
string(20) "/routingtest/foo/bar"

This means the first request after the IIS has started controls how SCRIPT_NAME is reported for all subsequent requests until the server is restarted again. This behavior confuses e.g. Symfony's HttpFoundation which uses SCRIPT_NAME and REQUEST_URI to determine the base path to the front controller script.

I don't really know if this is a bug in PHP or if this has to be fixed in IIS or the rewrite module. If I have to take this somewhere else, please point me into that direction.

PHP Version

8.1.22

Operating System

Windows 11

Inizia riproducendo la sequenza con index.php e la configurazione di IIS Rewrite su Windows 11 con PHP 8.1.22 tramite FastCGI. Confronta SCRIPT_NAME e REQUEST_URI tra richieste con maiuscole e minuscole diverse, quindi determina se il comportamento ha origine in PHP o in IIS/Rewrite. Il lavoro è completato quando viene identificato il componente responsabile e viene documentata o implementata una soluzione appropriata.