API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin

A request for /%2fadmin reaches your gateway. Your ACL blocks /admin. The gateway sees an encoded...