Blazor routing in .NET 8 interpreting %2f as /

[danroth27]

Discussed in #53622

^{Originally posted by gmeister99 January 25, 2024}
Hi all, I realise using an encoded forward slash (%2f) in a URL is not advised, however we have a website that uses the 'code' for a record in the URL. A code could be ABC/123. We then use it in the URL to determine what data to display on a generic page, e.g. /somepage/ABC%2f123

This used to work fine, as in the routing would go to the Blazor page with the @page directive "/somepage/{code}. But now, after upgrading the project to .NET 8, this url - /somepage/ABC%2f123 - experiences a page not found error, as it is interpreted by the Blazor routing engine as /somepage/ABC/123, which would be looking for a Blazor page with the @page directive matching "/somepage/{param1}/{param2}", which doesn't exist.

The robust solution would be to change the page to not use the 'code' in the URL, to completely avoid forward slashes. However, this page has worked for a couple of years like this without issue and is now impacting production, so I'm looking for a quick fix. Does anyone know of a setting, or some config that was changed/introduced somwhere in .NET8 that would influence routing?

Thanks

[gmeister99]

Thanks @danroth27, we ended up resolving this the quick way by moving the offending param into the query string, which doesn't impact Blazor routing. Our research of %2f in URLs indicates that it's a long standing behaviour, with the key takeaway being - don't include %2f in a URL. It's just odd that this used to work for us, but we decided to be on the safe side and make the change from our end.

[gragra33]

Discussed in #53622

Does anyone know of a setting, or some config that was changed/introduced somwhere in .NET8 that would influence routing?

Thanks

@danroth27 & @gmeister99 A quick fix could be to use base64 strings. The code would remain unchanged, just an extra step to encode and decode. This allows for other illegal characters, if required.

Update: The other workaround could be to over encode:

string code = "abc/123";

string encoded = WebUtility.UrlEncode(code);
Console.WriteLine(encoded);

string urlEncoded = WebUtility.UrlEncode(encoded);
Console.WriteLine(urlEncoded);

string urlDecoded = WebUtility.UrlDecode(urlEncoded);
Console.WriteLine(urlDecoded);

string decoded = WebUtility.UrlDecode(urlDecoded);
Console.WriteLine(decoded);

Which outputs the following:

abc%2F123
abc%252F123
abc%2F123
abc/123

[javiercn]

This was already fixed in main, and have a patch candidate #53538

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.