Path Normalization Disagreement
Compare how browser, CDN, cache, proxy, router, framework, and origin interpret path separators, dot segments, suffixes, and encoded delimiters. A different response is a lead, not a bypass, until the affected control boundary is proven.
Stop after confirmation. Do not escalate impact without separate authorization.
Dot segment comparison
Use a known route, one dot-segment variant, and a randomized nonexistent route. Record each hop and cache state before attributing the difference.
/known/./route/known/../known/route/known/%2e/route
Separator comparison
Duplicate or encoded separators can be normalized at different layers. Keep the destination equivalent and do not use traversal targets.
/known//route/known/%2froute/known/%5croute
Suffix and delimiter comparison
Semicolon, extension, and encoded query delimiters can change cache or router classification. Use unique cache busters and only controlled pages.
/known/route;control/known/route.css/known/route%3fcontrol
Evidence gate
Require a stable difference in authorization, cacheability, route selection, or response content that disappears in the paired control. Stop before affecting shared cached responses.
known route + variant + randomized nonexistent route + fresh cache key
Version history: normalized permanent page created 2026-08-20.