Use of Non-Canonical URL Paths for Authorization Decisions

Applications often define access rules for specific URLs, but many different URL formats can point to the same page. If the authorization check doesn't first convert URLs to a canonical (standardized) form, attackers can use variations like different character encodings, case changes, IP addresses instead of domain names, trailing slashes, or explicit port numbers to bypass security checks. Each variation appears different to the authorization system while loading the same protected content. To prevent this, always normalize URLs to a single canonical format before checking permissions. Implement a default-deny approach that rejects any non-standard URL format. This involves stripping unnecessary elements like default ports, removing trailing slashes, converting to lowercase, decoding encoded characters, and resolving hostnames consistently before any authorization decision is made.