# URL manipulation in case of path parameters

**URL:** <https://forum.djangoproject.com/t/url-manipulation-in-case-of-path-parameters/4785>\
**Category:** Using Django\
**Created:** [October 14, 2020, 1:09pm UTC](https://forum.djangoproject.com/t/url-manipulation-in-case-of-path-parameters/4785 "2020-10-14T13:09:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rohanjaswal2507](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rohanjaswal2507/32/2236_2.png) [@rohanjaswal2507](https://forum.djangoproject.com/u/rohanjaswal2507)\
**Post date:** [October 14, 2020, 1:09pm UTC](https://forum.djangoproject.com/t/url-manipulation-in-case-of-path-parameters/4785/1 "2020-10-14T13:09:46Z")

</div>

Hi people,

I have created an API using Django rest framework. The url paths look like  
/api/\<user\_id\>/documents/\<document\_id\>/  
/api/\<user\_id\>/addresses/\<address\_id\>/

Now, if I try to hit the url:

> /api/user\_id\_1/documents/document\_id\_1/…/…/…/…/api/user\_id\_2/addresses/address\_id\_2/

Then, in this case, I receive data about address\_2 in my response. The “…/” let the user to actually call the address endpoint. Is this any known issue? And is there any way to avoid such manipulation in urls?  
I believe this can pose many security risks with APIs using path parameters.

I am using Django 2.0.5. Please do let me know if this has already been addressed in any newer versions.

Thanks!

---

<div class="post-metadata">

**Author:** ![CodenameTim](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/codenametim/32/31507_2.png) [@CodenameTim](https://forum.djangoproject.com/u/CodenameTim)\
**Post date:** [October 14, 2020, 2:07pm UTC](https://forum.djangoproject.com/t/url-manipulation-in-case-of-path-parameters/4785/2 "2020-10-14T14:07:57Z")

</div>

I suspect you have your urls configured incorrectly. If you post your routing code, we may be able to help identify the problem.

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [October 14, 2020, 2:14pm UTC](https://forum.djangoproject.com/t/url-manipulation-in-case-of-path-parameters/4785/3 "2020-10-14T14:14:52Z")

</div>

While I agree that there may be some issues with your url configuration, this still shouldn’t be a “problem”.  
Generally speaking, security is applied at the view, not at the url. The urls map to views, yes - but it doesn’t matter how you get to the view. Whether you get to “view\_x” via `/api/view/x`, or `/api/view/../view/../view/x/../x/` shouldn’t matter. The view “view\_x” is supposed to verify that that user can access that view.