Double escaping and + symbol

[Iridio]

With .NET Core 2.1 and double escaping just the '+' sign is unescaped twice from the framework instead of once.
My code is as follow:

    [HttpGet("article/{productCode}/movements/{movementId:int}")]
    public async Task<IActionResult> MovementGet(string productCode, int movementId)
    {
    productCode = WebUtility.UrlDecode(productCode);
    //... rest of the code ...
    
    }

I than have created a web.config in the project folder to enable the double escaping for IIS/IISExpress

    <?xml version="1.0" encoding="utf-8"?>
    <configuration>
      <system.webServer>
        <security>
          <requestFiltering allowDoubleEscaping="true"/>
        </security>
      </system.webServer>
    </configuration>

A call for product code FMB+FTR97/MB06 with double escaping would be
http://localhost:4198/api/v1/warehouse/article/FMB%252BFTR97%252FMB06/movements/1946127

The anomaly (at least for me) is the product code the fw resolves, because I receive: FMB+FTR97%2FMB06 instead of FMB%2BFTR97%2FMB06 and when I call WebUtility.UrlDecode(productCode) I than get FMB FTR97/MB06 that is wrong.

At first I though was an IIS problem, but I tried the same code with ASP.NET 4.6 (with HttpUtilities.UrlDecode) and it worked as expected, I got FMB%2BFTR97%2FMB06

Am I using the web.config in the wrong way?

[Tratcher]

See https://github.com/aspnet/KestrelHttpServer/issues/2946

[Eilon]

One way to get out of this "mess" is to use the query string - that goes through a lot less processing and is far more predictable.

[Iridio]

Thanks at the moment I am using the following workaround:

 productCode = productCode.Replace("+", "%2b");
 productCode = WebUtility.UrlDecode(productCode);

[Iridio]

Anyway I still do not get why there is a partial double unescaping of the value. In my case the '+' is double unescaped while the other characters only once.
Is it changing the semantics of the url as per %2f?

[Tratcher]

Decoding plus to space is not appropriate for the path, I don't know why it's doing that.

[Iridio]

My guess is that it is interpreting the '+' sign as a concatenation symbol (like in query string), so space is the logic decoding

[Iridio]

I solved the problem. To get the correct encoding and decoding use double escaping with Uri.EscapeDataString(productCode) and Uri.UnescapeDataString(productCode)
`