frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

It is incorrect to "normalize" // in HTTP URL paths

https://runxiyu.org/comp/doubleslash/
23•pabs3•3h ago

Comments

WesolyKubeczek•1h ago
It is probably “incorrect”, but given the established actual usage over the decades, it’s most likely what you need to do nevertheless.

Not doing it is like punishing people for not using Oxford commas, or entering an hour long debate each time someone writes “would of” instead of “would have”. It grinds my gears too, but I have different hills to die on.

Etheryte•1h ago
Not sure I agree. The correct thing is to not mess with the URL at all if you're unsure about what to be doing to it. Doing nothing is the easiest thing of them all, why not do that?
j16sdiz•36m ago
because the you need some consistency or normalisation before applying ACL or do routing?
jeroenhd•13m ago
URL normalization is defined and it doesn't include collapsing slashes.

Not that you can include custom normalization rules (like collapsing slashes, tolower()ing the entire path, removing the query part of the URL), but that's not part of the standard. If you're doing anything extra, the risk of breaking stuff is on you.

bazoom42•32m ago
If different clients does it differently, you have incompatibilies. This punishes everybody. Since normalizing // to / removes information which may be significant, the obviously correct choice is folllowing the spec.
PunchyHamster•28m ago
if it is significant, you coded your app wrong, plain and simple
jeroenhd•14m ago
Of course not. It's an explicit feature part of every specification.

Plenty of websites rewrite paths like /a/b/c/d into a backend service call like /?w=a&x=b&y=c&z=d. In that scheme, /a//c/d would rewrite to /?w=a&x=&y=c&z=d, something entirely distinct from /a/c/d working out to /?w=a&x=b&y=c

It's not the application's fault that the people attempting to configure web server URLs don't know how web server URLs work.

MattJ100•1h ago
URL parsing/normalisation/escaping/unescaping is a minefield. There are many edge cases where every implementation does things differently. This is a perfect example.

It gets worse if you are mapping URLs to a filesystem (e.g. for serving files). Even though they look similar, URL paths have different capabilities and rules than filesystems, and different filesystems also vary. This is also an example of that (I don't think most filesystems support empty directory names).

mjs01•58m ago
// is useful if the server needs to serve both static files in the filesystem, and embedded files like a webpage. // can be used for embedded files' URL because they will never conflict with filesystem paths.
PunchyHamster•29m ago
....just serve it from other paths
sfeng•30m ago
What I’ve learned in doing this type of normalization is whatever the specification says, you will always find some website that uses some insane url tweak to decide what content it should show.
PunchyHamster•28m ago
We cut those and few others coz historically there were exploits relying on it

Nothing on web is "correct", deal with it

Category Theory Illustrated – Orders

https://abuseofnotation.github.io/category-theory-illustrated/04_order/
53•boris_m•2h ago•11 comments

Amiga Graphics

https://amiga.lychesis.net/
44•sph•2h ago•1 comments

Claude Design

https://www.anthropic.com/news/claude-design-anthropic-labs
1034•meetpateltech•18h ago•673 comments

Show HN: I made a calculator that works over disjoint sets of intervals

https://victorpoughon.github.io/interval-calculator/
142•fouronnes3•7h ago•22 comments

Measuring Claude 4.7's tokenizer costs

https://www.claudecodecamp.com/p/i-measured-claude-4-7-s-new-tokenizer-here-s-what-it-costs-you
604•aray07•17h ago•430 comments

Towards trust in Emacs

https://eshelyaron.com/posts/2026-04-15-towards-trust-in-emacs.html
102•eshelyaron•2d ago•12 comments

The simple geometry behind any road

https://sandboxspirit.com/blog/simple-geometry-of-roads/
19•azhenley•2d ago•4 comments

All 12 moonwalkers had "lunar hay fever" from dust smelling like gunpowder (2018)

https://www.esa.int/Science_Exploration/Human_and_Robotic_Exploration/The_toxic_side_of_the_Moon
329•cybermango•14h ago•191 comments

Spending 3 months coding by hand

https://miguelconner.substack.com/p/im-coding-by-hand
205•evakhoury•16h ago•203 comments

It is incorrect to "normalize" // in HTTP URL paths

https://runxiyu.org/comp/doubleslash/
25•pabs3•3h ago•15 comments

Rewriting Every Syscall in a Linux Binary at Load Time

https://amitlimaye1.substack.com/p/rewriting-every-syscall-in-a-linux
40•riteshnoronha16•4d ago•14 comments

A simplified model of Fil-C

https://www.corsix.org/content/simplified-model-of-fil-c
173•aw1621107•11h ago•93 comments

Are the costs of AI agents also rising exponentially? (2025)

https://www.tobyord.com/writing/hourly-costs-for-ai-agents
198•louiereederson•2d ago•51 comments

Brunost: The Nynorsk Programming Language

https://lindbakk.com/blog/introducing-brunost
61•atomfinger•4d ago•23 comments

Show HN: Smol machines – subsecond coldstart, portable virtual machines

https://github.com/smol-machines/smolvm
326•binsquare•15h ago•100 comments

Slop Cop

https://awnist.com/slop-cop
173•ericHosick•17h ago•104 comments

Show HN: PanicLock – Close your MacBook lid disable TouchID –> password unlock

https://github.com/paniclock/paniclock/
188•seanieb•16h ago•81 comments

"cat readme.txt" is not safe if you use iTerm2

https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not
179•arkadiyt•14h ago•99 comments

Hyperscalers have already outspent most famous US megaprojects

https://twitter.com/finmoorhouse/status/2044933442236776794
188•nowflux•16h ago•154 comments

Middle schooler finds coin from Troy in Berlin

https://www.thehistoryblog.com/archives/75848
229•speckx•18h ago•107 comments

NASA Force

https://nasaforce.gov/
271•LorenDB•17h ago•266 comments

Landmark ancient-genome study shows surprise acceleration of human evolution

https://www.nature.com/articles/d41586-026-01204-5
77•unsuspecting•10h ago•62 comments

Michael Rabin Has Died

https://en.wikipedia.org/wiki/Michael_O._Rabin
14•tkhattra•2d ago•0 comments

NIST gives up enriching most CVEs

https://risky.biz/risky-bulletin-nist-gives-up-enriching-most-cves/
200•mooreds•18h ago•51 comments

Casus Belli Engineering

https://marcosmagueta.com/blog/casus-belli-engineering/
37•b-man•7h ago•9 comments

Making Wax Sealed Letters at Scale

https://waxletter.com/
17•hjconstas•2d ago•12 comments

Introducing: ShaderPad

https://rileyjshaw.com/blog/introducing-shaderpad/
92•evakhoury•2d ago•18 comments

The Unix executable as a Smalltalk method (2025) [video]

https://www.youtube.com/watch?v=sZjPQ7vtLNA
53•surprisetalk•1d ago•4 comments

Arc Prize Foundation (YC W26) Is Hiring a Platform Engineer for ARC-AGI-4

https://www.ycombinator.com/companies/arc-prize-foundation/jobs/AKZRZDN-platform-engineer-benchma...
1•gkamradt_•12h ago

The GNU libc atanh is correctly rounded

https://inria.hal.science/hal-05591661
90•matt_d•3d ago•20 comments