Netflix Zuul query string encoding

This is a copy of the stackoverflow issue: http://stackoverflow.com/questions/36475845/netflix-zuul-query-string-encoding

When sending a request via Zuul to a client, Zuul seems to change the query String. More specifically, if the client should receive an url-encoded query String, Zuul decodes the query String once. Here is a concrete example:

If “http://localhost:8080/demo/demo?a=http%3A%2F%2Fsomething/” is sent to the client, the client receives as a query String “a=http://something/”.

Looking into Zuul`s code, the function “buildZuulRequestQueryParams” uses “HTTPRequestUtils.getInstance().getQueryParams();” which decodes the query String.

Is this a desired feature or a bug?

[haagrawa]

Just add following in application.yml file zuul : forceOriginalQueryStringEncoding: true

This will internally encode again your query param. You can also refer method buildHttpRequest() of class SimpleHostRoutingFilter

[hohwille]

Zuul simply does too much auto-magic here and therefore some apps stop working if they are operated behind zuul as reverse proxy. An example is e.g. foswiki that uses semicolon instead of ampersand as separator for query parameters. See also here for discussions on that but however, the w3c standard seems to allow this: https://stackoverflow.com/questions/3481664/semicolon-as-url-query-separator However, zuul does not allow this: https://github.com/Netflix/zuul/blob/c87e0c2a6b65a19ca8eb493d281ee812f7b60794/zuul-core/src/main/java/com/netflix/zuul/util/HTTPRequestUtils.java#L166

Ampersand as separator is considered as fixed separator char and semicolon is not honored. Hence everything behind the first equals sign is considered as value. Therefore subsequent equals signs are falsely escaped to %3D resulting in an invalid URL. An actual URL of a foswiki registration link send via Email looks as following: http://zuul.mydomain.org/foswiki/bin/register?action=approve;code=MyLogin.9285561;referee=AdminUser I can neither configure foswiki to use ampersand instead of semicolon nor I can make zuul pass these requests properly to the physical wiki server without breaking the request URL.

Conclusion: IMHO zuul is buggy here and needs to be fixed.