private String normalizePath(String path) {
  if (path == null || path.isEmpty()) {
    return "/";
  }

  try {
    // URL decode the path to handle percent-encoded characters like %2F
    String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8);

    // Normalize multiple consecutive slashes to single slashes
    String normalizedPath = decodedPath.replaceAll("/+", "/");

    // Split into segments and resolve path traversal
    String[] segments = normalizedPath.split("/");
    List<String> resolvedSegments = new ArrayList<>();

    for (String segment : segments) {
      if (segment.isEmpty() || ".".equals(segment)) {
        // Skip empty segments and current directory references
        continue;
      } else if ("..".equals(segment)) {
        // Go up one directory level
        if (!resolvedSegments.isEmpty()) {
          resolvedSegments.remove(resolvedSegments.size() - 1);
        } else {
          // Attempting to go above root - this is a security violation
          throw new IllegalArgumentException("Path traversal attack detected: " + path);
        }
      } else {
        // Add normal segment
        resolvedSegments.add(segment);
      }
    }

    // Reconstruct the path
    StringBuilder result = new StringBuilder();
    for (String segment : resolvedSegments) {
      result.append("/").append(segment);
    }

    // Ensure the result starts with / and handle empty path case
    String finalPath = result.toString();
    return finalPath.isEmpty() ? "/" : finalPath;

  } catch (Exception e) {
    // If URL decoding fails or any other error occurs, throw security exception
    throw new IllegalArgumentException("Invalid path format: " + path, e);
  }
}

private boolean matchesPathPattern(String pattern, String requestPath) {
  // Normalize both paths to prevent path traversal attacks
  String normalizedPattern = normalizePath(pattern);
  String normalizedRequestPath = normalizePath(requestPath);

  // Split both paths into segments
  String[] patternSegments = normalizedPattern.split("/", -1); // keep trailing empty segments
  String[] requestSegments = normalizedRequestPath.split("/", -1);

  // Paths must have the same number of segments
  if (patternSegments.length != requestSegments.length) {
    return false;
  }

  // Compare each segment
  for (int i = 0; i < patternSegments.length; i++) {
    String patternSegment = patternSegments[i];
    String requestSegment = requestSegments[i];

    // If both are empty (leading/trailing slash), continue
    if (patternSegment.isEmpty() && requestSegment.isEmpty()) {
      continue;
    }
    // If pattern segment is a path parameter (enclosed in {}), it matches any non-empty segment
    if (isPathParameter(patternSegment)) {
      if (requestSegment.isEmpty()) {
        return false;
      }
    } else {
      // For literal segments, they must match exactly
      if (!patternSegment.equals(requestSegment)) {
        return false;
      }
    }
  }

  return true;
}

if (blockedDeleteSession) {
  BlockedRoute deleteSessionRoute = new BlockedRoute("DELETE", "/session/{session-id}");
  // Only add if not already present
  if (routes.stream()
      .noneMatch(
          route ->
              "DELETE".equals(route.getMethod())
                  && "/session/{session-id}".equals(route.getPath()))) {
    routes =
        Stream.concat(routes.stream(), Stream.of(deleteSessionRoute))
            .collect(Collectors.toList());
  }
}