What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web apps?

1 Answer 1


Your web server should not be responsible for correct encoding of user supplied input. If this would cause you to be vulnerable to injection, it means that your application does not sanitize user input correctly.

It has always been considered a security issue because the application running on the web server weren't always escaping the input correctly, resulting in path traversals. But the responsibility for the issue ultimately lies with the web application, not the web server. So if your application correctly escapes these values, you should be alright.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .