You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Simply using the http.StripPrefix helper to strip a known prefix.
What did you see happen?
When the request path is exactly the prefix, the req.URL.Path is set to the empty string instead of /. This can break downstream handlers, as they can reasonably expect the path to not be empty per RFC 7230 §5.3.1
See also net/http: ServeFile panics when StripPrefix over-strips and results in empty path #30165, which is basically running into this as well.
When the prefix is URL encoded, this incorrectly results in a 404 response because the RawPath cannot be simply stripped with strings.TrimPrefix. Example: prefix = "/prefix", request path = "/pr%65fix/somepath", expected handler path = "/somepath", actual response = "404 page not found"
What did you expect to see?
For problem 1, I'd expect / as the path.
For Problem 2, I'd expect the prefix to be correctly stripped from the RawPath as well as the Path. There should not be a 404 response in case the requested path contains escape sequences in the prefix part.
I'd also expect the semantics of RawPath to be preserved, i.e. it should only be set if Path cannot be unambiguously encoded. Therefore, a request which has any encoded characters only in the prefix part, should not have RawPath set after it was handled by http.StripPrefix.
Go version
go version go1.26.0 darwin/arm64
Output of
go envin your module/workspace:What did you do?
Simply using the
http.StripPrefixhelper to strip a known prefix.What did you see happen?
req.URL.Pathis set to the empty string instead of/. This can break downstream handlers, as they can reasonably expect the path to not be empty per RFC 7230 §5.3.1See also net/http: ServeFile panics when StripPrefix over-strips and results in empty path #30165, which is basically running into this as well.
RawPathcannot be simply stripped withstrings.TrimPrefix. Example: prefix = "/prefix", request path = "/pr%65fix/somepath", expected handler path = "/somepath", actual response = "404 page not found"What did you expect to see?
For problem 1, I'd expect
/as the path.For Problem 2, I'd expect the prefix to be correctly stripped from the
RawPathas well as thePath. There should not be a 404 response in case the requested path contains escape sequences in the prefix part.I'd also expect the semantics of
RawPathto be preserved, i.e. it should only be set ifPathcannot be unambiguously encoded. Therefore, a request which has any encoded characters only in the prefix part, should not haveRawPathset after it was handled byhttp.StripPrefix.