`normalize_url` lowercases the entire URL, silently deduplicating case-distinct pages
Description
normalize_url lowercases the entire URL, including the path and query, even though its docstring says it only converts the scheme and netloc to lower case:
Since compute_unique_key uses the normalized URL as the default unique_key, any two URLs that differ only in path or query casing collide:
https://example.com/Product/ABCandhttps://example.com/product/abcproduce the same unique key.https://example.com/?token=SeCrEtandhttps://example.com/?token=secretcollide as well.
Per RFC 3986, only the scheme and host are case-insensitive. The path and query are case-sensitive.
Impact
On sites with case-sensitive paths (base64 or hashid identifiers, usernames, ...), case-distinct pages are silently deduplicated. The crawl finishes successfully with pages quietly missing. There's no log message and no statistic that would reveal it.
Proposed fix
Lowercase only the scheme and host, which matches browser behavior. Keep the path, query, and fragment casing intact.
This changes how default unique keys are computed: crawls that relied on the case-insensitive dedup will now visit more pages, and keys stored in persisted queues won't match newly computed ones. It should therefore land in 2.0 as a breaking change:
- Document the change loudly in the upgrading guide.
- Users who need the old behavior can pass an explicit
unique_keyor usetransform_request_functionto lowercase URLs before enqueuing.
Source: apify/crawlee-python