Double url-encoding of query string with ALB

I’ve found that if I send a get request to FastAPI like GET eg.com/something?name=John+Smith then the database query generated uses literally John+Smith. Same situation using %20.

It seems that Mangum is doing a second round of url-encoding on the query strings, so when FastAPI (or whatever might sit in the middle) decodes the query string it gets the once-encoded version back.

I’m working with an Application Load Balancer.

I’m not 100% sure what the correct behaviour should be, or whether the URL encoding behaviour should be different between API gateway and ALB.

I’ll create a pull request with a failing test for this in a moment.

Some references:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html “If the query parameters are URL-encoded, the load balancer does not decode them. You must decode them in your Lambda function.”

with ALB source, serverless-wsgi decodes and then encodes the query strings before passing off to WSGI: https://github.com/logandk/serverless-wsgi/blob/f8d5a92f63901ed25d1a09ae19fcaa791e22436f/serverless_wsgi.py#L82-L93

Related issues from serverless-express https://github.com/vendia/serverless-express/issues/241 https://github.com/vendia/serverless-express/issues/219

[nathanglover]

@jordaneremieff I think this can be closed now? Since you merged #184

[jurasofish]

Yeah #155 looks pretty good. From reading it, looks like it:

• performed double encoding of query params (bug)
• handled returning multi value headers and multi value query strings correctly (including detecting whether multi-value headers are enabled from the ALB input)
• tested the multi value query string/headers stuff well.