New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.3.19

v26.3.19​

Oathkeeper applies strip_path only to the start of the request path​

upstream.strip_path is removed only when it matches whole path segments at the start of the incoming request path. The path of upstream.url is never modified.

Percent-encoded characters in strip_path now match their decoded values. For example, both /a&b and /a%26b match the request path /a%26b. Literal reserved characters such as & remain supported. Encode a literal % as %25: to match a literal %26 in a path segment, use %2526 in strip_path. Prefixes containing invalid percent escapes, such as /100%, no longer match; use /100%25 instead.

Breaking changes​

Rules that relied on strip_path matching in the middle of the request path, part of a segment, or the upstream.url path now forward the request unchanged.