Exactly. This is only a vulnerability if you send the same raw url to two different systems and base your security on expecting them to treat it identical, to t

Exactly. This is only a vulnerability if you send the same raw url to two different systems and base your security on expecting them to treat it identical, to the point of being bug-for-bug compatible. As we’ve seen with multiple other vulnerabilities this can be very fragile. Especially when the complexity of the protocol grows, the recent saml signature mixups being a good example of such https://news.ycombinator.com/item?id=28064835 https://news.ycombinator.com/item?id=28064835 If your auth/proxy parses some parameters used by both the proxy and the app it should forward what it parsed, not the original unparsed data. Only exception is a cache or a best-effort-firewall, but then it’s no longer a vulnerability, just an ordinary bug.