From d4ef6e83cf020a3ca85b9ba05bd16b643e605ba9 Mon Sep 17 00:00:00 2001
From: Alex van Andel <me@alexvanandel.com>
Date: Thu, 13 Nov 2025 02:20:05 +0100
Subject: [PATCH] fix: Make identifier for rate limit URL safe (#25111)

---
 apps/web/middleware.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts
index ef44d9e8d3..cb8f50f19b 100644
--- a/apps/web/middleware.ts
+++ b/apps/web/middleware.ts
@@ -101,7 +101,7 @@ const middleware = async (req: NextRequest): Promise<NextResponse<unknown>> => {
   try {
     await checkRateLimitAndThrowError({
       rateLimitingType: "common",
-      identifier: `${req.nextUrl.pathname}-${piiHasher.hash(requestorIp)}`,
+      identifier: `${encodeURIComponent(req.nextUrl.pathname)}-${piiHasher.hash(requestorIp)}`,
     });
   } catch (error) {
     if (error instanceof HttpError) {