{
  "id": 19312466,
  "title": "The 403 Bypass Playbook: Path Normalization and Reverse-Proxy Discrepancies",
  "url": "https://urgent.news/2026/11/10/the-403-bypass-playbook-path-normalization-and-reverse-proxy",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T09:30:00.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/medjahdi/the-403-bypass-playbook-path-normalization-and-reverse-proxy-discrepancies-kf2"
  },
  "original_language": "en",
  "account": "When a web application returns a 403 Forbidden response, it's not an automatic end to the investigation. Senior penetration testers view a 403 as an opportunity to explore parser differences and reverse-proxy discrepancies. Modern applications often have multiple layers, including edge gateways, web application firewalls (WAFs), and reverse proxies like Cloudflare, Nginx, HAProxy, and Envoy, which route traffic to backend servers such as Node, Spring Boot, Flask, or Go.\n\nThe key to exploiting these discrepancies lies in understanding path normalization and reverse-proxy header overrides. Path normalization refers to how the proxy and backend parse the URL differently. For example, a request to GET /admin/..;/dashboard may be treated differently by Nginx and a Tomcat/Spring backend. Nginx may not match the /admin ACL block, while the backend would strip the /..;/ and respond with the protected controller.\n\nReverse-proxy header overrides also play a significant role. Many internal systems rely on legacy routing headers, such as X-Original-URL or X-Forwarded-Prefix, to determine the actual request path. The WAF might see a harmless request, while the backend reads the original header and applies the appropriate routing, leading to unauthorized access.\n\nOther techniques include verb tampering and method overriding, where access control is tied to specific HTTP methods like GET, POST, or HEAD. Case and extension tricks can also be leveraged to bypass authentication, such as trying GET /Admin/Dashboard, GET /admin/dashboard.json, or GET /admin/dashboard/ with a custom query parameter.\n\nTo mitigate these issues, it's crucial to normalize the path before inspection. Canonicalize and decode the URL to ensure consistent parsing. Strip any client-supplied routing headers at the edge so they cannot be manipulated to inject unauthorized paths. Finally, adopt a zero-trust approach at the backend, validating identity and role for every request instead of relying solely on the edge gateway. By understanding and exploiting these vulnerabilities, testers can uncover critical vulnerabilities that might otherwise go unnoticed.",
  "summary": "A 403 is rarely the end of the story. Here's the playbook senior testers run when an endpoint says Forbidden. You find a juicy endpoint during recon: GET /admin/dashboard ➔ 403 Forbidden Most people close the tab and move on. Senior testers treat a 403 as an invitation to test parser discrepancy — because modern apps aren't one monolith. They sit behind edge gateways, WAFs and reverse proxies…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}