Search code examples
securityurlurl-rewritingowasp

Allowing "//" in URL.Any Security Standards for URL Definition?

I am allowing '\api\v3\getDetails' in my API Definition.xml. Are there any standards to define a URL? Are there any security impacts when allowing these types of definitions?

Security Standard for Defining a URL.Is it ethical to Define a URL Starts with "\".

Solution

  • The "standard" for characters usable in URLs and how to encode other characters is the ABNF in RFC 3986 (https://datatracker.ietf.org/doc/html/rfc3986#appendix-A). Doing something different to this is likely to break in at least some implementations of a web server, browser, script, or dependency. I'm not sure what you mean by ethical, but from both a functionality and a security standpoint using a character (that is intended under the standard to be encoded) without correct encoding increases your risks.