Remix.run Logo
cxr 2 hours ago

> This assumes that „the reverse proxy requests a different URL upstream from what it got as a request“ is wrong. Who says that it is?

For this case (double/multiple slash "normalization"), the author of this post is saying that—and they're saying RFC 3986 says so, too.

> Which RFC forbids a reverse proxy from rewriting the request URL?

Ibid.

> If I have a legacy PHP app that expects values as query strings and I use a reverse proxy to map the URL path to those query strings, is that wrong too? Would it be wrong if my reverse proxy did that by default?

Clearly, it's not wrong if you selected and/or configured a software package specifically for the purpose of providing that functionality. And clearly it is wrong if it were to do that when not configured to do anything other than act as generic middleware, with that software's creator(s) operating under the assumption that it's safe to do so all while arguing that it's standards-compliant.

echoangle 2 hours ago | parent [-]

> For this case (double/multiple slash "normalization"), the author of this post is saying that—and they're saying RFC 3986 says so, too.

No. The RFC says that the rewritten URL is not considered the same URL. But nothing says that the reverse proxy has to request the same URL.

The rewrite is not a normalization, but nothing says that the reverse proxy is only allowed to do normalization.

> Clearly, it's not wrong if you selected and/or configured a software package specifically for the purpose of providing that functionality. And clearly it is wrong if it were to do that when not configured to do anything other than act as generic middleware, with that software's creator(s) operating under the assumption that it's safe to do so all while arguing that it's standards-compliant.

It’s not wrong and it is standards-compliant, because no standard says that the default has to be „pass the original URL on without rewriting it“.