Multiple forward slashes in the URL

Bug Reports
1

I’m not sure whether this is a bug with Bootstrap Studio or something related to Cloudflare.

The other day, I noticed that on my main site—hosted entirely on Cloudflare—you can add an unlimited number of forward slashes to a URL in a web browser and, instead of returning a 404 error or resolving to the correct URL, the page still loads normally.

To check whether this was specific to Cloudflare, I tested the same thing on a separate site hosted using Bootstrap Studio’s free hosting, and I get the same behaviour.

For example, this is a page on the test site:
https://forwardslash.bss.design/services.html

But I can add an unlimited number of forward slashes, such as:
https://forwardslash.bss.design/////////////////services.html

The same page is displayed.

I’ve searched online, but the only suggestions point towards “URL normalisation”. After experimenting with the settings, nothing seems to change the behaviour.

Any help?

2

This isn’t a bug. It’s intentional behavior called URL path normalization. Most web servers (Apache, Nginx, IIS) and frameworks treat multiple consecutive slashes in the path portion of a URL as equivalent to a single slash. This comes from long-standing Unix filesystem conventions and is allowed by the URL specification (RFC 3986), which leaves some normalization decisions up to implementations. As a result, /page.html and ////page.html usually resolve to the same resource.

You’ll find it on heavyweights like amazon and wikipedia.

3 Likes
3

As printninja pointed out, it is normal server behaviour.

However, if for some reason you do not see that happening on a specific site, it could be for one of the following reasons:

Modern web applications use path routers with regular expressions. Enforcing strict matching would break with non exact matches, relaxed matching would allow.

Or they have it turned off using a Nginx directive called merge_slashes.
Default behaviour is to have it on: merge_slashes on;
To disable it: merge_slashes off’;

Another reason you might not see multiple forward slashes work on a site url is if a WAF (web application firewall) was set to be very strict with paths. Sometimes that is done to mitigate against possible path traversal attacks.

In summary, it is perfectly normal server behaviour that is helpful in allowing the url to collapse and return a page. But, you may still find some sites that don’t allow it.