The allowReserved check runs against request.URL.Query(), which percent-decodes values. A compliant client sending a comma as %2C (e.g. ?filter[dateRange]=2026-05-17%2C2026-07-17) is decoded back to , before the reserved-character regex runs, so the request is rejected with "Query parameter 'filter' value contains reserved values".
Per OAS 3.1.1, allowReserved is a serialization rule: with false (the default), reserved characters in the data must be percent-encoded on the wire — it does not forbid the data from containing them.
Expectation
The check should run against the raw (still-encoded) value from request.URL.RawQuery, flagging only literal reserved characters.
The allowReserved check runs against
request.URL.Query(), which percent-decodes values. A compliant client sending a comma as%2C(e.g.?filter[dateRange]=2026-05-17%2C2026-07-17) is decoded back to,before the reserved-character regex runs, so the request is rejected with "Query parameter 'filter' value contains reserved values".Per OAS 3.1.1, allowReserved is a serialization rule: with false (the default), reserved characters in the data must be percent-encoded on the wire — it does not forbid the data from containing them.
Expectation
The check should run against the raw (still-encoded) value from
request.URL.RawQuery, flagging only literal reserved characters.