What is URL percent-encoding?

Short answer

Percent-encoding is the writing, as % followed by two hexadecimal digits, of characters that have a special meaning in a URL or cannot be written directly: a space becomes %20, / becomes %2F, ? becomes %3F and # becomes %23 (RFC 3986). For letters, digits and the - . _ ~ characters, the encoded and unencoded forms carry the same meaning (/a%62c and /abc are the same path); for this reason, the same address can arrive in different spellings, and rules that look at only one spelling can be bypassed. In TR7, the URL Normalization action brings the request to a single form before forwarding it to the Backend Service: Decode Percent-Encoded Characters decodes the encoding of only letters, digits and the - . _ ~ characters, and does not decode separator encodings such as %2F or %3F; Make Percent-Encoded Characters Uppercase converts the letters in the encoding to uppercase (%2f → %2F); URL Encode # Character encodes the # character as %23. On the WAF side, the decoding of the path is determined by the URL Decoding setting in the Checks window.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions (Policy Actions) → URL normalization form	Normalization → Decode percent-encoded characters	Decoding the encodings of letters, digits and - . _ ~ (%61dmin → admin)
Same field	Normalization → Make percent-encoded characters uppercase	Bringing the encodings to a single form (%2f → %2F)
Same field	Normalization → URL Encode # character	Encoding the # character as %23
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Checks card	URL Decoding	Using the decoded form of the path in WAF inspection

The options in the Normalization field are applied in the order in which they are displayed in the field; the order is changed by drag and drop (Normalization). The decoding of query and form values by the WAF does not depend on the setting: What does the URL Decoding setting affect; are query and form values decoded too?

Common Misconceptions

• "Decoding all encodings is the safest way." Decoding separators such as %2F changes the meaning of the path; this is why Decode Percent-Encoded Characters decodes only the encodings of letters, digits and - . _ ~. Since %25 is not decoded either, multi-layer encoding (%252F) is not unwrapped.
• "Encoding is only a difference in appearance." In rule and signature matching, different spellings can be a way of bypassing; URL normalization and the WAF's URL decoding reduce this risk.
• "A request that contains broken encoding is rejected." URL normalization does not reject requests that contain broken percent-encoding; the relevant part is left as it is.

How it is done in the documentation

• URL Normalization · Normalization
• URL Normalization · Scenario 2: Making the Percent Encoding Consistent
• Checks · URL Decoding

Related questions

• What does the URL Decoding setting affect; are query and form values decoded too?
• What are the parts of a URL (scheme, host, path, query string)?
• What is the difference between a multipart form and a URL-encoded form?