How URL normalization works
URL normalization modifies separators, encoded elements, and literal bytes in incoming URLs so that they conform to a consistent formatting standard.
For example, consider a firewall rule that blocks requests whose URLs match www.example.com/hello. The rule would not block a request containing an encoded element — www.example.com/%68ello. Normalizing incoming URLs at the edge helps simplify Cloudflare firewall rules expressions that use URLs.
The URL normalization performed according to RFC-3986 is as follows:
- The following unreserved characters are
percent decoded:
- Alphabetical characters:
a-z,A-Z(decoded from%41-%5Aand%61-%7A) - Digit characters:
0-9(decoded from%30-%39) - hyphen
-(%2D), period.(%2E), underscore_(%5F), and tilde~(%7E)
- Alphabetical characters:
- These reserved characters are not encoded or decoded:
: / ? # [ ] @ ! $ & ' ( ) * + , ; = - Other characters, for example literal byte values, are percent encoded.
- Percent encoded representations are converted to upper case.
- URL paths are normalized according to the Remove Dot Segments protocol.
In addition to the rules defined in RFC-3986, Cloudflare can apply the following extra normalization techniques:
- Normalize back slashes (
\) into forward slashes (/). - Merge successive forward slashes (for example,
//will be normalized to/).
The performed URL normalization varies according to the configured settings. For more information, refer to URL normalization settings .
URL normalization examples
The following table shows some examples of URL normalization when using the Cloudflare normalization type :
| URL | Normalized URL |
|---|---|
example.com/en/hello/ |
example.com/en/hello/ |
example.com/en//%68ello\path |
example.com/en/hello/path |
example.com\hello |
example.com/hello |
example.com/./en//hello./ |
example.com/en/hello./ |