Security

URL Encoding (Percent-Encoding)

A scheme for representing characters in a URL as a percent sign followed by two hexadecimal digits, for example %50 for the letter P. Because a single path can be spelled in many valid encoded forms, security rules that match one literal spelling can be bypassed by an equivalent encoded variant.

Deep dive

Learn Article

Why URL Encoding Lets Attackers Slip Past String-Matching WAF Rules

A firewall that matches a literal path is defeated by a request spelling the same path differently. How percent-encoding creates a parser mismatch, and why you should normalize before deciding.

intermediate 5 min read

Back to glossary