Slash in query param not being encoded as %2F about url HOT 5 CLOSED

What makes you think these need to be escaped? They are not ambiguous, as they are not part of the target. See rfc3986:

https://datatracker.ietf.org/doc/html/rfc3986#section-3.4

      query       = *( pchar / "/" / "?" )

   The characters slash ("/") and question mark ("?") may represent data
   within the query component.

The RFC even explicitly states that it is better not to escape them:

                                However, as query components
   are often used to carry identifying information in the form of
   "key=value" pairs and one frequently used value is a reference to
   another URI, it is sometimes better for usability to avoid percent-
   encoding those characters.

from url.

To complement the answer, the only possible component after the query is a fragment. So the only delimiter after the query is a #. That's why ? and / are allowed in the query.

from url.

@vinniefalco ok makes sense. I was going off this link:

https://en.m.wikipedia.org/wiki/Percent-encoding

additionally, the AWS S3 rest API requires it:

https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html

from url.

Yes. Unreserved Characters can be used in any component, although individual components can allow more than the unreserved set. For instance:

$> node
new URL('http://www.example.com/a/s/b?f=g/s')
URL {
  href: 'http://www.example.com/a/s/b?f=g/s',
  origin: 'http://www.example.com',
  protocol: 'http:',
  username: '',
  password: '',
  host: 'www.example.com',
  hostname: 'www.example.com',
  port: '',
  pathname: '/a/s/b',
  search: '?f=g/s', // <--------
  searchParams: URLSearchParams { 'f' => 'g/s' },
  hash: ''
}

Whoever wrote the AWS tutorial got that wrong if it's meant as a requirement. I'd be surprised if the server rejects a request because a "/" in the query is unencoded.

from url.

@vinniefalco its not that the AWS server rejects explicitly if slashes aren’t escaped but the issue is that the authorization signature is calculated based on what they call uri-encoded query params. So if we don’t escape the slash when calculating the signature, their signature won’t match and then they reject.

Anyway, topic for another forum. Thanks for the help

from url.