Extra slashes causes route error

Extra slashes in the URL change the routing. For example, /x and //x do not route the same way. Here’s a unit test which demonstrates this:

https://gist.github.com/robnagler/1a5d0361cc71a6806fc6

If you put a proxy in front of flask, it will normalize the URLs so this isn’t an issue. It would seem, however, that Flask should normalize the URLs as well.

[robnagler]

On most operating systems, extra slashes resolve to one. URLs came from file system notation so it would seem that the two should respond in the same way.

Apache removes duplicate slashes for a good reason.

Nginx has the merge_slashes directive, which is on by default.

RFC 3986 seems to imply you can’t have multiple, contiguous slashes:

      path          = path-abempty    ; begins with "/" or is empty
                    / path-absolute   ; begins with "/" but not "//"
                    / path-noscheme   ; begins with a non-colon segment
                    / path-rootless   ; begins with a segment
                    / path-empty      ; zero characters

      path-abempty  = *( "/" segment )
      path-absolute = "/" [ segment-nz *( "/" segment ) ]
      path-noscheme = segment-nz-nc *( "/" segment )
      path-rootless = segment-nz *( "/" segment )
      path-empty    = 0<pchar>
      segment       = *pchar
      segment-nz    = 1*pchar
      segment-nz-nc = 1*( unreserved / pct-encoded / sub-delims / "@" )
                    ; non-zero-length segment without any colon ":"

      pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"

Note that path-* require segment-nz. segment-nz requires at least one pchar, which cannot be a slash.

[davidism]

This is a Werkzeug issue, reported at pallets/werkzeug#1132.