HAProxy Best Pratices

Consider encoded URLs in path-based rules

When creating HAProxy rules based on request paths, make sure encoded URLs are also taken into account. A rule that only evaluates the raw URL may behave differently when percent-encoded characters are used.

As a best practice, use url_dec when relevant so that your rules are applied consistently to both plain and encoded URLs.

For example, if a rule is intended to allow, deny, or redirect access based on a specific path, make sure it evaluates the decoded path rather than only the raw encoded value.

This helps make HAProxy rules more reliable and reduces the risk of unexpected behavior in path-based filtering.

Keep rules explicit and easy to maintain

Prefer clear and narrowly scoped rules over broad matching patterns. Rules that are too generic can be difficult to understand and may have unintended side effects.

Whenever possible:

• use explicit path or host matching
• avoid overlapping rules when a simpler structure is possible
• document the purpose of custom rules

Validate rules with realistic request variations

Before deploying a new rule to production, test it with different types of requests, including:

• standard requests
• encoded URLs
• unexpected path variations
• query strings when relevant

This helps confirm that the rule behaves as expected in real-world conditions.

Review the impact of rule order

HAProxy rules are evaluated in order, so the placement of a rule can change the final behavior. When adding a new rule, always verify that it does not conflict with existing allow, deny, redirect, or rewrite logic.

A good practice is to review new rules together with the full request flow rather than in isolation.