Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web apps?

share|improve this question

Your web server should not be responsible for correct encoding of user supplied input. If this would cause you to be vulnerable to injection, it means that your application does not sanitize user input correctly.

It has always been considered a security issue because the application running on the web server weren't always escaping the input correctly, resulting in path traversals. But the responsibility for the issue ultimately lies with the web application, not the web server. So if your application correctly escapes these values, you should be alright.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.