Authentication bypass via inconsistent path normalization

A walkthrough of how mismatched path handling between a proxy and an application can bypass authentication controls, and how to prevent it.

On this page

Access-control bypasses frequently arise not from a single flawed check, but from two components that disagree about what a request means. Path normalization is a classic source of that disagreement.

The class of bug

A gateway enforces “requests to /admin require authentication,” then forwards the raw request to an application. If the gateway and the application normalize paths differently, trailing segments, encoded separators, dot-segments, case, an attacker can craft a path the gateway treats as public but the application resolves to a protected handler.

Root cause

The vulnerability is a confused deputy: the security decision is made against one interpretation of the path, while the sensitive action is performed against another. Neither component is individually wrong; the composition is.

Prevention

Normalize once, early, and canonically, then make every downstream component operate on the canonical form. Enforce authorization at the resource that performs the action, not only at the edge. Add tests that assert equivalent encodings resolve to the same authorization outcome.

This is clearly-marked sample content produced for development and testing. It describes a general vulnerability class, not a specific real-world incident.