# Encoded URL not matching path\_beg or url\_dec

**URL:** <https://discourse.haproxy.org/t/encoded-url-not-matching-path-beg-or-url-dec/6710>\
**Category:** Help!\
**Created:** [July 7, 2021, 9:38pm UTC](https://discourse.haproxy.org/t/encoded-url-not-matching-path-beg-or-url-dec/6710 "2021-07-07T21:38:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PJ\_1004](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@PJ\_1004](https://discourse.haproxy.org/u/PJ_1004)\
**Post date:** [July 7, 2021, 9:38pm UTC](https://discourse.haproxy.org/t/encoded-url-not-matching-path-beg-or-url-dec/6710/1 "2021-07-07T21:38:12Z")

</div>

Hello, I have a restricted\_access acl applying based on a path\_beg check for specific sub-pages of websites.  
This works fine for web browser requests and correctly returns a 403 error, however when using an encoded url, the check is bypassed and a 200 response is received.

HAProxy is v2.2.8

I have come across the implementation of url\_dec and this does not seem to work either.

Current syntax:  
acl restricted\_path path\_beg /testpath  
http-request deny if restricted\_path

I have tried:  
acl restricted\_path path\_beg,url\_dec -i /testpath

- this resulted in no pages being blocked and allowed all, both standard and encoded urls

acl restricted\_path path\_beg url\_dec -i /testpath

- changing to space-delimited meant that standard urls were blocked again but encoded urls still pass

acl restricted\_path path\_beg url\_dec /testpath

- no change

acl restricted\_path path\_beg url\_dec -m /testpath

- no change

acl restricted\_path path url\_dec -i beg /testpath

- no change

The documentation on url\_dec is very light in the manual - does anyone have a working example that would successfully block (return 403) requests as follows?

testing examples:

- curl -k “[https://www.example.com/testpath/index.php](https://www.example.com/testpath/index.php)”
- curl -k “[https://www.example.com/testpath/index.php](https://www.example.com/testpat%68/index.php)”

---

<div class="post-metadata">

**Author:** ![PJ\_1004](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@PJ\_1004](https://discourse.haproxy.org/u/PJ_1004)\
**Post date:** [July 11, 2021, 8:53pm UTC](https://discourse.haproxy.org/t/encoded-url-not-matching-path-beg-or-url-dec/6710/2 "2021-07-11T20:53:15Z")

</div>

The testing example didn’t quite work as the html was decoded in this post.

The ‘h’ in the second example should be replaced with % 6 8

---

<div class="post-metadata">

**Author:** ![PJ\_1004](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@PJ\_1004](https://discourse.haproxy.org/u/PJ_1004)\
**Post date:** [July 11, 2021, 9:44pm UTC](https://discourse.haproxy.org/t/encoded-url-not-matching-path-beg-or-url-dec/6710/3 "2021-07-11T21:44:12Z")

</div>

We believe we have found a solution for this.  
To benefit others with the same issue, our fix is here:

acl restricted\_path path\_beg,url\_dec -m beg -i i /testpath

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [July 12, 2021, 8:30am UTC](https://discourse.haproxy.org/t/encoded-url-not-matching-path-beg-or-url-dec/6710/4 "2021-07-12T08:30:40Z")

</div>

There is an experimental feature in Haproxy 2.4 that helps with URI normalization for this exact purpose, this could be handy:

[http://cbonte.github.io/haproxy-dconv/2.4/configuration.html#4.2-http-request%20normalize-uri](http://cbonte.github.io/haproxy-dconv/2.4/configuration.html#4.2-http-request%20normalize-uri)