Use the ASGI raw_path in the router

[ChiliJohnson]

It would be nice if the router could be configured to use the ASGI raw_path instead of the path when matching routes, right now, for example, the router cannot distinguish between requests made to /my/great/route and /my%2Fgreat/route because it seems like the scope's path property is pre-unquoted by the time the router gets a hold of it.

I'd like to be able to define a set of routes which look like this for example:
• /{param:path}/some/path
• /{param:path}

And if I make a request for /example%2Fsome%2Fpath, I'd expect to match that latter route, but currently it matches to the former. Either converting the router so that it uses the raw_path, or adding some flag to enable this would offer a lot of flexibility here!

If anyone's curious about a concrete use case for this, I'm specifically interested in the IIIF Image API, where this ability to distinguish between these routes would be required. Currently this is something that WSGI/werkzeug seems to handle intuitively but it would be great to be able to use ASGI/starlette for this as well!

[kefir-]

To add to this, I would say that this is a bug, not an idea. Starlette behaviour of interpreting %2F as / is against W3C recommendations, as described in Example 2 at https://www.w3.org/Addressing/URL/4_URI_Recommentations.html

Screenshot:

Also RFC 3986 section 2.2 states:

URIs that differ in the replacement of a reserved character with its corresponding percent-encoded octet are not equivalent.

/ is a reserved character.

[Kludex]

How does Django and Flask behave?

MREs are appreciated.

[kefir-]

They are also in conflict with RFC 3986 and W3C recommendations, as far as I know. That doesn't makes things more correct.

Apparently an implicit consequence of the wording of pep-3333 suggests this behaviour, but that is in conflict with the mentioned sources above, which are explicit on this behaviour, and should take precedence anyway.

I have created an issue for this on pep-3333 itself, but there doesn't seem to be much interest in this issue.

python/peps#3280

[adriangb]

For what it’s worth, I have encountered this in the past, and had to redesign my URL structure. I don’t have a strong opinion on what the right thing to do is but I know the current behavior can be a pain.

[kefir-]

Thanks for sharing. I think more people should speak up when this is an issue, because this is surprising behaviour,
and in my opinion it's quite clearly broken. Unfortunately it is also anchored in pep-3333, so it's a common problem across most python frameworks.

[nggit]

That's correct. This is because the path is decoded early in the server, making it less flexible (but this is an ASGI specification).
In reality it makes more sense to decode after routing.

While excluding %2F from being decoded at path is awkward and may lead to security issues.

In this case raw_path is clearer and more useful.

[A-Neal]

I'm having to rewrite my API implementation to ingest all user-created strings using POST requests now because of this issue. Maybe that's the conventionally proper way to do it, but it definitely led me on a wild goose chase because I never expected a string encoded as a URI component would get treated as if it weren't by the API library I'm using.