aws-amplify / aws-amplify/amplify-hosting
Amplify Hosting SSR compute appears to normalize %2B to + in query string
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [x] I have checked to see if my question is addressed in the FAQ.
- [x] I have searched for duplicate or closed issues.
- [x] I have read the guide for submitting bug reports.
- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.
### App Id
Not provided
### AWS Region
Not provided
### Amplify Hosting feature
SSR compute / request routing
### Describe the bug
A request sent to an Amplify Hosting SSR app with a percent-encoded plus sign (`%2B`) in a query parameter appears to arrive at hosted compute with that sequence normalized to a literal `+`.
This is observable before app-level query parsing. The app logs the raw path and search value it receives from the platform/framework request URL.
Original request URL:
```text
https://example.com/signup/verify?code=123456&email=user%2Balias%40example.com&id=00000000-0000-4000-8000-000000000000
```
Hosted compute log:
```text
[GET] - /signup/verify?code=123456&email=user+alias%40example.com&id=00000000-0000-4000-8000-000000000000
```
That changes the meaning of the query value. `%2B` is a literal plus sign. A raw `+` in form-style query parsing is commonly decoded as a space, so standard URL parsing turns the value into:
```text
user alias@example.com
```
instead of:
```text
user+alias@example.com
```
This breaks common flows that include email aliases or other values where `+` is meaningful.
### Expected behavior
Amplify Hosting should preserve the incoming encoded query string when forwarding the request to SSR compute.
For the request above, hosted compute should receive a raw path/search equivalent to:
```text
/signup/verify?code=123456&email=user%2Balias%40example.com&id=00000000-0000-4000-8000-000000000000
```
or otherwise preserve semantics so app code can read `email` as:
```text
user+alias@example.com
```
### Reproduction steps
1. Deploy an SSR app to Amplify Hosting compute.
2. Add request logging before route-specific app logic. Example shape:
```ts
console.info(`[${request.method}] - ${url.pathname}${url.search}`);
console.info(url.searchParams.get("email"));
```
3. Request a URL containing `%2B` in a query parameter:
```text
/signup/verify?code=123456&email=user%2Balias%40example.com&id=00000000-0000-4000-8000-000000000000
```
4. Check hosted compute logs.
### Observed behavior
The raw search string visible to the app contains `email=user+alias%40example.com` instead of `email=user%2Balias%40example.com`.
Then normal query parsing reads the email as `user alias@example.com`.
### Additional context
This is not about app code passing an unencoded `+` in the original URL. The original request uses `%2B`, which is the correct encoding for a literal plus sign in a query parameter.
This also does not appear to be route-specific. It is visible in generic request logging for the hosted SSR app.
Contributor guide
Research direction
Start by reproducing the request against an Amplify Hosting SSR compute deployment using the URL and request-logging steps in the issue. Compare the original encoded query string with the raw search value visible to the app and verify whether `%2B` is changed before application parsing. Done means preserving the encoded value or preserving the email parameter's literal-plus semantics.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100