Configure Tomcat to Allow Slash and Backslash in Page Names

Last modified by Eleni Cojocariu on 2026/10/05 13:40

Steps

XWiki removes slashes (/) and backslashes (\) from Page names by default. To allow them:

  1. Allow / and \ in the "Name Strategies" administration section, by removing them from the forbidden characters of the Model Validation Strategy.
  2. Enable encoded slash support in Tomcat by adding the system property:
    -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true
  3. Enable backslash support in Tomcat by adding the system property:
    -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true
  4. Add both properties to CATALINA_OPTS to make the configuration persistent:
    CATALINA_OPTS="$CATALINA_OPTS \
    -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true \
    -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true"
  5. Configure CATALINA_OPTS in your environment using the appropriate mechanism for your system (for example setenv.sh, setenv.bat, or system-wide Tomcat configuration files).
  6. Restart Tomcat to apply the changes.
  7. Configure the HTTP reverse proxy in front of the Servlet Container, if there is one, to pass %2F and %5C through undecoded. Apache HTTP Server needs AllowEncodedSlashes NoDecode and the nocanon option on its ProxyPass line, and answers 404 for such a URL without them; NginX needs a proxy_pass carrying no path, and otherwise forwards a normalized path that reaches a different Page.
  8. Create a Page whose name contains a slash or a backslash. XWiki saves it and serves its URL without returning an HTTP 400 error.

FAQ

Why do I need to enable these Tomcat properties?

Tomcat blocks encoded slashes / and backslashes \ (%2F or %5C in URLs) characters by default for security reasons, which prevents XWiki from using them in Page names.

Related

Get Connected