edge WAF is 401-ing legit Unicode (—, ', é)
justinmbale
FREEOP

2 hours ago

Hitting my service's Railway domain directly (hashsmash-production.up.railway.app, my own Cloudflare bypassed):

POST /api/events with "description":"night — out" (em-dash, U+2014) → 401, Server: railway-hikari, empty body.

Same request with "night out" (no em-dash) → 201.

Also 401s on curly apostrophe ' (U+2019) and accented letters (é). Emoji and -- are fine.

It even 401s a permitAll endpoint, so it's not my app's auth — it's your railway-hikari edge rejecting legit UTF-8 in the request body.

Server: railway-hikari

x-railway-edge: den1

Content-Length: 0

Solved$10 Bounty

4 Replies

Railway
BOT

2 hours ago

This thread has been opened as a bounty so the community can help solve it.

Status changed to Open Railway about 2 hours ago


2 hours ago

Respectfully, the consensus in this post is wrong. This is, in fact, your application returning the 401; it is not being returned by anything on our end.


Status changed to Awaiting User Response Railway about 2 hours ago


brody

Respectfully, the consensus in this post is wrong. This is, in fact, your application returning the 401; it is not being returned by anything on our end.

justinmbale
FREEOP

an hour ago

I don't have any thing related to Hikari in my entire stack. Do you have any suggestions where this is coming from? Looks like railway-hikari specifically.

Server: railway-hikari

x-railway-edge: den1

Content-Length: 0


Status changed to Awaiting Railway Response Railway about 1 hour ago


an hour ago

Hikari is our CDN, but it is unrelated to your application returning a 401. Hikari is simply passing along the status code that your application set.


Status changed to Awaiting User Response Railway about 1 hour ago


brody

Hikari is our CDN, but it is unrelated to your application returning a 401. Hikari is simply passing along the status code that your application set.

justinmbale
FREEOP

an hour ago

Thank you for that explanation that helped solve this.

Down the end of the rabbit hole it turns out my powershell script for creating data was actually creating non UTF-8 characters (while my app was not) so the app was legitimately catching junk characters and not allowing them.


Status changed to Awaiting Railway Response Railway about 1 hour ago


Status changed to Solved Railway about 1 hour ago


Welcome!

Sign in to your Railway account to join the conversation.

Loading...