Browser converts encoded slash (%2F) to literal slash (/) in path portion of URL

Question

I'm currently working with an email confirmation after registration using ASP.NET Identity.

This library provides a token generation which is needed to complete the registration. This token is used in our application in the following path:

https://localhost/#/account/{token}/setup

And the token is generated by invoking:

var emailToken = _userManager.GenerateEmailConfirmationToken(newUser.Id);

Once I have my token generated, I add it in the path by doing a string.Format this way:

string.Format("https://localhost/#/account/{0}/setup", HttpUtility.UrlEncode(emailToken));

The result looks like this:

https://localhost/#/account/AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA6gbQhGTTMUWVHDgOwC9T9AAAAAACAAAAAAAQZgAAAAEAACAAAAAqo%2fiAv8iIn7Zox9pS3MOUMVNisAo7Bnada6%2f9wKEe6wAAAAAOgAAAAAIAACAAAABUu7WkD9vHvN2EDz2%2bqGwvJ4j6gj%2f4PaBTbI861jfEcWAAAADJV74LZjKAXv5v1FqYVuWLyTpPBCnLfopSi3rsEEwMHFKwltHL3moL2h%2fvYVs%2fu3LB%2br5Qytuu%2fZYOUWQTY5KzBqHeZoi7RJ02emDI0NTRhIKxfSGGIdbYxuAjsW14G0BAAAAACsC8L%2bdUDzFMgKUOkxWhKofAz8L0mH5VFEt8Oq%2fKYsxIiu4fiA2sGlPfDhhKQnV2lg%2ba8qHydUjqmyfxNex0Pg%3d%3d/setup

but when I open this url in the browser I get:

...and so on!

What I see is that the url is encoded correctly in the body of the email, but is decoded when I open it in the browser by replacing the encoded "%2f" to "/". This leads to an invalid route in my application being that I expect the "/" to be a separator between different resources.

Any thoughts of this behaviour?

References:

Another guy with my problem too

Answer 1

It's probably decoding it because it considers it part of the path.

I would suggest you explicitly treat it as a parameter. That will tell the browser not to decode it. For instance, instead of having this path:

https://localhost/#/account/AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA6gbQh..........

Use this path:

https://localhost/#/account/?t=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA6gbQh......

Notice the addition of ?t= after the end of the account path.

Then consume the t parameter in your application. That will tell the browser that the value at the end is not to be decoded as part of the path but rather preserved in encoded form because it's a parameter.

This would obviously change the path you have (because of the setup part) so adjust accordingly.