URL (percent) encoding should not be applied to unreserved characters #936
Comments
Good catch! |
Sounds good to me. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Function
url.escape
currently encodes all characters other than alphanumeric ASCII and underscore. This is going beyond what the encoding specification calls for and against its recommendation of not encoding so-called unreserved characters, namely:Per RFC 3986, section 2.3:
This guidance is also aligned with the specification for
application/x-www-form-urlencoded
at https://url.spec.whatwg.org/#urlencoded-serializing.This "over-encoding" is causing issues with some HTTP targets that do not process such payloads correctly. As such, I am proposing to update
url.lua
not to encode these unreserved characters:(The first of the two changes is done for consistency reasons; it is not technically necessary because all unreserved characters are included in
segment_set
. The second change is the critical one.)Please leave a note if you have any questions or concerns. Otherwise the patch will be committed in a few weeks.
The text was updated successfully, but these errors were encountered: