Collected research

Browser scheme/slash quirks

Browser Scheme and Slash Quirks

Arshan Dabirsiaghi · i8jesus.com

While defeating a product that blocked anything resembling a URL in a Location header, the author found browsers accept malformed scheme/slash forms. Internet Explorer follows http:\\google.com with backslashes, and Firefox 3 accepts http:///google.com with three slashes, in tags and redirects alike, so open-redirect filters that only match well-formed URLs fail.

Record

Document

Browser Scheme and Slash Quirks

Researcher

Arshan Dabirsiaghi

Published by

i8jesus.com

Topic

Browser

In the archive

• Collected in the 2009 research round

Tags

• open-redirect
• url-parsing
• filter-bypass
• parser-differential
• waf-bypass
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Arshan Dabirsiaghi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.