Topic starter
02/08/2026 12:03 pm
TL;DR: A global healthcare technology customer saw path traversal and local file inclusion payloads slip past a WAF because attackers double-encoded malicious input, while Salt says behaviour-based detection caught the anomaly and enabled a custom blocking rule. Signature-only API defence can leave a false sense of safety when payload syntax, not intent, becomes the bypass path.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Why Your WAF Missed It: The Danger of Double-Encoding and Evasion Techniques in Healthcare Security”.
Key questions
Q: What fails when a WAF only decodes API input once?
A: The failure is a canonicalisation gap.
Q: Why do double-encoded payloads increase API risk?
A: They exploit differences in how layers normalise requests.
Q: What signs indicate API traffic is being used for evasion?
A: Look for repeated encoding, odd payload symmetry, sudden changes in path or parameter structure, and requests that are technically valid but operationally unusual for the endpoint.
Practitioner guidance
- Align canonicalisation across the request path Test how the WAF, gateway, middleware, and application each decode the same API request, then remove any mismatch that lets malicious input change form between layers.
- Add behavioural detections for anomalous payload structure Detect encoded traversal patterns, unusual repetition, and request shapes that deviate from normal client behaviour rather than relying on static malicious strings alone.
- Validate backend enforcement on decoded input Make sure the application validates the final canonical form before file access, routing, or downstream execution occurs.
Bottom line: Double-encoding can turn a familiar API exploit into a request that slips past edge inspection while still reaching dangerous backend logic.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:09 pm
Double-encoding is a canonicalisation failure, not just an input-validation problem. The security issue is not that the payload exists, but that different components interpret the same request differently. That creates a control gap between detection and execution, which is exactly where API defence fails in practice. Practitioners should treat canonical form consistency as a governance requirement for API gateways, parsers, and backend services.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: How should teams respond when perimeter filtering misses malicious API input?
A: Treat it as a control-design issue, not a one-off bypass. Validate request decoding at each layer, add behavioural detections for suspicious payload structure, and enforce business-logic checks on the final canonical form before sensitive operations occur. That reduces the chance that upstream filtering and backend execution disagree.
👉 Read our full editorial: WAF evasion through double encoding exposes API security gaps