Backslashes can accidentally allow users to access protected routes

In a write-up on octri.dev, the author shows an Nginx exact-match block on /admin/dashboard being bypassed with /admin%5Cdashboard: Nginx passed the normalized path, and Node's WHATWG URL parser treated the backslash as a separator and ran the admin handler. A 750-request test across 10 configurations also found routers disagreeing on encoded slashes. The test results are the author's own and unsourced. For builders, the point is to authorize the route the backend resolves, not rely on edge path rules.