Hacker News Viewer

It is incorrect to "normalize" // in HTTP URL paths

by pabs3 on 4/18/2026, 5:47:10 AM

https://runxiyu.org/comp/doubleslash/

Comments

by: MattJ100

URL parsing&#x2F;normalisation&#x2F;escaping&#x2F;unescaping is a minefield. There are many edge cases where every implementation does things differently. This is a perfect example.<p>It gets worse if you are mapping URLs to a filesystem (e.g. for serving files). Even though they look similar, URL paths have different capabilities and rules than filesystems, and different filesystems also vary. This is also an example of that (I don&#x27;t think most filesystems support empty directory names).

4/18/2026, 7:59:37 AM


by: PunchyHamster

We cut those and few others coz historically there were exploits relying on it<p>Nothing on web is &quot;correct&quot;, deal with it

4/18/2026, 8:43:29 AM


by: sfeng

What I’ve learned in doing this type of normalization is whatever the specification says, you will always find some website that uses some insane url tweak to decide what content it should show.

4/18/2026, 8:42:09 AM


by: mjs01

&#x2F;&#x2F; is useful if the server needs to serve both static files in the filesystem, and embedded files like a webpage. &#x2F;&#x2F; can be used for embedded files&#x27; URL because they will never conflict with filesystem paths.

4/18/2026, 8:13:30 AM


by: WesolyKubeczek

It is probably “incorrect”, but given the established actual usage over the decades, it’s most likely what you <i>need</i> to do nevertheless.<p>Not doing it is like punishing people for not using Oxford commas, or entering an hour long debate each time someone writes “would of” instead of “would have”. It grinds my gears too, but I have different hills to die on.

4/18/2026, 7:55:06 AM