What is the best practice for the endpoint URL, with or without a trailing slash?

[thomasturrell]

I have seen AU's behave in three different ways:

• Requires a slash at the end of the endpoint URL
• Requires no slash at the end of the endpoint URL
• Handles slash or no slash at the end of the endpoint URL

The behaviour in AU's I have observed leads to three possible URL's

• https://example.com/xapistatements (results in a 404)
• https://example.com/xpai//statements (blocked by some HTTP firewalls as a potential directory traversal attack due to the double slash)
• https://example.com/xpai/statements (Ok)

Is the onus on the LMS to always send an endpoint with a trailing slash (and therefore the AU doesn't add one) or for the AU handle either case?

I notice that this issue has been discussed in the xAPI spec.

[brianjmiller]

I think

Handles slash or no slash at the end of the endpoint URL

Is really the only workable solution and not that difficult, particularly when using libraries that are available.

[MrBillMcDonald]

This is an xAPI spec issue (Review per June 3, 20220 meeting)