Why PR #478 from 2013 fixing the use of URL separator (slash) has never been commited to master/main ?

[ypapouin]

This basic api call cannot work because serial number slashes are parsed by the werzeug route manager:
/api/test/v1/serial/MT/122/11112222/Action
So the good way to process this use case is to encode the url to:
/api/test/v1/serial/MT%2F122%2F11112222/Action

But I just go the issue described in the PR when working with Odoo http routes. (that rely on werkzeug, my venv is using version 2.0.2 actually).

Looking for a fix about having slashes in url, I found out that a solution was proposed: #478, and it seems to do it properly (maybe should use urllib.parse.unquote_plus instead of replace)

But this PR has been closed without being committed to the main branch, does that mean that there is an another workaround ?

[davidism]

It's not possible to fix in Flask or Werkzeug. Many popular HTTP servers, such as Apache httpd and Nginx, do this by default, so by the time it gets to us the URL is already decoded. We can't know what proxies are above the application and what they're doing, so we have to assume the lowest common denominator and treat slashes as decoded. Otherwise, users could go from dev to prod and get different routing behavior and not know why.

See django/asgiref#87, pallets/flask#2507, pallets/flask#900, #21, and other previous discussions.

The dev server, and some production servers, provide the non-standard REQUEST_URI or RAW_URI in the environ. If you know for sure that all proxies above you when deploying do not decode slashes, you can write a middleware to treat that as PATH_INFO.

[ypapouin]

Thank your for the explanation.