From fed4b2da5984262a4697f2b10102ea4076c66025 Mon Sep 17 00:00:00 2001
From: Chris Troutner <chris.troutner@gmail.com>
Date: Mon, 29 Dec 2025 18:06:43 -0700
Subject: [PATCH] fix(forward slashes): Adding middleware to detect multiple
 forward slashes in the URL

---
 bin/server.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/bin/server.js b/bin/server.js
index 3d2b2ca..6a6d7a6 100644
--- a/bin/server.js
+++ b/bin/server.js
@@ -74,6 +74,19 @@ class Server {
         allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With']
       }))
 
+      // URL normalization middleware - collapse multiple slashes
+      app.use((req, res, next) => {
+        if (req.path && req.path.includes('//')) {
+          // Collapse multiple consecutive slashes into a single slash
+          const normalizedPath = req.path.replace(/\/+/g, '/')
+          // Reconstruct req.url with normalized path
+          const queryString = req.url.includes('?') ? req.url.substring(req.url.indexOf('?')) : ''
+          req.url = normalizedPath + queryString
+          req.path = normalizedPath
+        }
+        next()
+      })
+
       // Apply basic auth middleware if enabled
       // This must run before x402 middleware to set req.locals.basicAuthValid
       if (basicAuthSettings.enabled) {