Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

The core issue is a flawed sequence in request handling. If authorization is performed on a raw, unparsed URL, an attacker can craft requests using alternate path representations that the server interprets differently after the security check. For example, directory traversal sequences like '/./' or multiple slashes might not be recognized as equivalent to a standard path during the initial authorization phase. To prevent this, servers must fully parse, resolve, and canonicalize all URLs—converting them to a single, standard absolute form—before evaluating any access rules. This ensures the path being checked is the same one the server will actually use to locate the resource, closing the gap between authorization logic and filesystem access.