2026-09-02 · 8 min read
- url
- routing
- security
A request target passes through browsers, CDNs, load balancers, reverse proxies, application servers, frameworks, and application code. Each layer may validate, normalize, preserve, or decode percent-encoded bytes.
Encoded separators such as %2F are especially risky because one layer may see one segment while another sees two. Similar disagreement over backslashes, dot segments, repeated slashes, and encoded percent signs can break routing, caching, signatures, and access control.
Define representations at trust boundaries
Document the raw request target available at each hop, the normalized path used for routing, and the decoded values passed to application code. Do not use the words raw path without identifying the server API and its exact behavior.
- Separate path-segment encoding from query-value encoding.
- Record whether percent escapes are decoded once or rejected.
- Define handling for encoded slash and backslash characters.
- Use the same canonical path for policy and resource lookup.
Prefer path-safe identifiers
Choose opaque identifiers that use an unreserved alphabet when possible. If a domain value naturally contains separators, place it in a query parameter or body rather than relying on every intermediary to preserve an encoded slash.
Base64url can make binary identifiers path-safe, but specify its alphabet, padding, maximum decoded size, and canonical form. Encoding does not make an identifier confidential or trustworthy.
Align routing, authorization, caches, and signatures
Normalize at a clearly owned boundary and reject ambiguous alternatives. Route matching, authorization, cache keys, rate-limit keys, logs, and filesystem or object-store lookup should agree on the resulting identity.
Signed URLs require the signer and verifier to canonicalize the same path representation. Never decode opportunistically until a signature passes, and do not let redirects create a second unsigned interpretation.
- Reject traversal-like dot segments after the defined decoding step.
- Keep proxy and framework normalization settings versioned.
- Avoid cache keys built from a different path than origin routing.
- Log safe canonical identifiers without sensitive query values.
Test the complete deployment path
Use Flashman's URL tool to inspect component encoding, diff to compare path forms, Base64 tool for path-safe fixtures, JSON formatter for gateway events, and hash tool to label canonical signature inputs.
Test direct and proxied requests, upper- and lowercase escapes, encoded separators, encoded percent signs, single and double encoding, repeated slashes, dot segments, Unicode, redirects, cache behavior, signatures, route generation, authorization, and production server upgrades.