Glossary
Canonicalization
Canonicalization converts an input to a single, standard, unambiguous form before any policy or access-control decision is evaluated against it. Without it, different components in a system — a proxy, an application, a file system — can each interpret differences in how the same underlying resource can be represented in more than one way, and disagree about what a given input actually refers to.
This becomes an authorization bypass specifically when a security check evaluates one representation while a downstream component acts on a different, but equivalent, one — a check that correctly denies one written form of a request can be defeated entirely by an attacker submitting an alternate encoding of the exact same underlying request that the check simply doesn't recognize as equivalent.