Hacker News Reader

Comment by WesolyKubeczek | Hacker News Reader

It is probably “incorrect”, but given the established actual usage over the decades, it’s most likely what you need to do nevertheless.

Not doing it is like punishing people for not using Oxford commas, or entering an hour long debate each time someone writes “would of” instead of “would have”. It grinds my gears too, but I have different hills to die on.

View on HN

If different clients does it differently, you have incompatibilies. This punishes everybody. Since normalizing // to / removes information which may be significant, the obviously correct choice is folllowing the spec.

if it is significant, you coded your app wrong, plain and simple

Of course not. It's an explicit feature part of every specification.

Plenty of websites rewrite paths like /a/b/c/d into a backend service call like /?w=a&x=b&y=c&z=d. In that scheme, /a//c/d would rewrite to /?w=a&x=&y=c&z=d, something entirely distinct from /a/c/d working out to /?w=a&x=b&y=c

It's not the application's fault that the people attempting to configure web server URLs don't know how web server URLs work.

A sane configuration, of course, would collapse the slashes first, so it would be /?w=a&x=c&y=d&z=.

See, it’s because when we do these acrobatics with turning path elements into query parameters, we do it for humans, so they are more readable. Humans can make typos, and accidentally entering two slashes instead of one is not exactly unheard of.

If we do it for some other code, we shouldn’t be rewriting anything at all, and just use query parameters.

Why?

Not sure I agree. The correct thing is to not mess with the URL at all if you're unsure about what to be doing to it. Doing nothing is the easiest thing of them all, why not do that?

because the you need some consistency or normalisation before applying ACL or do routing?

URL normalization is defined and it doesn't include collapsing slashes.

Not that you can include custom normalization rules (like collapsing slashes, tolower()ing the entire path, removing the query part of the URL), but that's not part of the standard. If you're doing anything extra, the risk of breaking stuff is on you.

If someone gives you a nonsense URL, the correct response is 404, not to try and guess what they could've maybe meant.

Reply on news.ycombinator.com