Backslashes can accidentally allow users to access protected routes
Comments on “Backslashes can accidentally allow users to access protected routes”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
In a write-up on octri.dev, the author shows an Nginx exact-match block on /admin/dashboard being bypassed with /admin%5Cdashboard: Nginx passed the normalized path, and Node's WHATWG URL parser treated the backslash as a separator and ran the admin handler. A 750-request test across 10 configurations also found routers disagreeing on encoded slashes. The test results are the author's own and unsourced. For builders, the point is to authorize the route the backend resolves, not rely on edge path rules.
Why it ranked
No. 9 of 107 with a score of 0.71. The panel rated it highest on technical depth (0.85) and practical relevance (0.84), lowest on significance (0.59). The judges disagreed most on new information (spread 0.43), so the story is marked contested. Placed No. 9, No. 5 by score alone: the fifth Security story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Well-substantiated, reproducible security write-up on URL parser disagreement across proxies and frameworks; practically useful for builders, though a known bug class with some unverified cited claims.
- AI judgeJudge 3gpt-5.6-luna
- A reproducible, technically specific demonstration of URL-parser disagreement causing authorization bypasses, with broad relevance to proxies, routers, middleware, and backend security. Practical mitigations and cross-stack comparisons strengthen it.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.71total under rubric v2.3Contestedjudges differ by 0.43 on new information
- Significance0.59
- Reader interest0.81
- Audience breadth0.68
- Practical relevance0.84
- Substantiated0.75
- Technical depth0.85
- New information0.76
- Counts against: Promotional0.04
- Counts against: Overclaim0.23
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.64 | 0.45 | 0.68 | 0.59 | 0.23 | +0.24 | +0.142 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.78 | 0.80 | 0.86 | 0.81 | 0.08 | +0.26 | +0.211 |
| Audience breadthHow many people who build technology does it concern? | 0.81 | 0.60 | 0.62 | 0.68 | 0.21 | +0.13 | +0.088 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.92 | 0.80 | 0.82 | 0.84 | 0.12 | +0.22 | +0.186 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.86 | 0.60 | 0.78 | 0.75 | 0.26 | +0.05 | +0.037 |
| Technical depthHow technically substantive is it? | 0.99 | 0.80 | 0.76 | 0.85 | 0.23 | +0.05 | +0.043 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.84 | 0.50 | 0.93 | 0.76 | 0.43 , above the contested threshold | +0.05 | +0.038 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.05 | 0.01 | 0.04 | 0.04 | −0.19 | −0.007 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.26 | 0.35 | 0.08 | 0.23 | 0.27 | −0.11 | −0.025 |
| Sum of contributions | +0.713 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.713 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-07/9/"><img src="https://rubric.hrih.si/badge/2026-11-07/9.svg" alt="Ranked #9 on Rubric, 7 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 4 matches source · 3 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
The author sent 25 HTTP request variants through 10 server configurations, repeating each three times, for 750 recorded requests.
The article gives no link or citation for it.
The article says “I sent 25 HTTP request variants through 10 server configurations, repeating each case three times”
The source says No source to compare with.
No source givenNumber
All 750 requests received responses with no transport errors, and each server-and-request combination produced the same result across all three repetitions.
The article gives no link or citation for it.
The article says “All 750 requests received responses, with no transport errors. Each server-and-request combination produced the same result across all three repetitions”
The source says No source to compare with.
No source givenNumber
With the Nginx exact-match rule, a request to /admin%5Cdashboard returned 200 and reached the Node admin handler, while /admin/dashboard and /admin%2Fdashboard returned 403.
The article gives no link or citation for it.
The article says “admin%5Cdashboard 200 Admin handler reached”
The source says No source to compare with.
Matches sourceVersion
Node's WHATWG URL parser follows the URL Standard and treats backslashes as path separators for special URL schemes such as HTTP.
The cited source says the same thing.
The article says “For special URL schemes such as HTTP, that parser treats backslashes as path separators”
The source says “if url is special and c is U+005C (\), invalid-reverse-solidus validation error”
Source cited by the article: url.spec.whatwg.org
Matches sourceVersion
Go's http.ServeMux preserves escaped path elements for routing, so an encoded slash is not treated as an ordinary separator when matching route segments.
The cited source says the same thing.
The article says “escaped path elements are preserved for routing purposes. An encoded slash isn't treated as an ordinary separator when matching route segments”
The source says “Escaped path elements such as "%2e" for "." and "%2f" for "/" are preserved and aren't considered separators for request routing”
Source cited by the article: pkg.go.dev/net/http
Couldn’t checkDate
The Fastify maintainers published a critical security advisory for @fastify/express on October 27, 2026.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On October 27, 2026, the Fastify maintainers published a critical security advisory for @fastify/express”
The source says No passage could be compared.
Source cited by the article: github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746
Matches sourceVersion
The @fastify/express vulnerability affected versions 4.0.5 through 4.0.8 under a non-default routing configuration and was fixed in version 4.0.9.
The cited source says the same thing.
The article says “The vulnerability affected versions 4.0.5 through 4.0.8 under a particular non-default routing configuration”
The source says “fastify/express versions >= 4.0.5, < 4.0.9, when Fastify runs with routerOptions.ignoreDuplicateSlashes: true”
Source cited by the article: github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746
Matches sourceCausal conclusion
The Fastify router and Express middleware integration handled an absolute-form request target differently when duplicate-slash normalization was enabled, letting a request skip path-scoped authentication, authorization or rate-limiting middleware.
The cited source says the same thing.
The article says “Fastify's router and the Express middleware integration handled an absolute-form request target differently when duplicate-slash normalization was enabled”
The source says “Fastify's router (find-my-way) resolves the absolute-form target to its path and dispatches the handler, while the Express layer no longer sees the scoped path”
Source cited by the article: github.com/fastify/fastify-express/security/advisories/GHSA-6h42-57hq-9746
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 7 pts, not on front page
Recorded for context only, checked 7 Nov 2026, 05:47 UTC. It played no part in the ranking.