[Edit]

to%2Fendpoint)

1 contributors

2 contributions

0 discussions

7 points

Created by:

Palus-Bear

1016

In this short article, we would like to show how in Apache2 enable encoded slashes support in path segments.

By default, it is not permitted to use %2F in path segments, that causes 404 response in Apache2 server, and it is necessary to enable it.

Quick solution:

Add the following line into your host configuration:

xxxxxxxxxx
 
<VirtualHost *:80>
    AllowEncodedSlashes On
</VirtualHost>

or:

xxxxxxxxxx
 
<VirtualHost *:80>
    AllowEncodedSlashes NoDecode
</VirtualHost>

Warning: be careful using %2F in the paths, because some software may do not interpret it well,
e.g. some bots that crawl your website may decode URLs before calling your pages.

Available cases

Edit

This section contains description for possible AllowEncodedSlashes values that allows using encoded slashes in URLs.

VirtualHost Configuration Description

xxxxxxxxxx
 
<VirtualHost *:80>
    ...
    AllowEncodedSlashes On
    ...
</VirtualHost>

In that configuration URLs with %2F are accepted, and encoded slashes are decoded like all other encoded characters.

It means: /path%2Fto%2Fapi will be decoded to /path/to/api and passed to the web application logic.

xxxxxxxxxx
 
<VirtualHost *:80>
    ...
    AllowEncodedSlashes NoDecode
    ...
</VirtualHost>

In that configuration URLs with %2F are accepted, but encoded slashes are not decoded but left in their encoded state.

It means: /path%2Fto%2Fapi will be not decoded but passed to the web application logic with %2F.

Sometimes it is necessary to allow slashes usage with proxy, which can lead to use nocanon parameter in ProxyPass.

Example:

xxxxxxxxxx
 
<VirtualHost *:80>
    ...
    AllowEncodedSlashes NoDecode
    ...
    ProxyPass /proxy http://127.0.0.1:8080/ nocanon
    ...
</VirtualHost>