Take a look at the following attack on a Web Server using obstructed URL: How would you protect from these attacks?

Blocking all hex-encoded characters at the web server level would break legitimate functionality, as percent-encoding is a required part of the URI specification for many valid requests.

Creating IDS rules to alert on strange or anomalous Unicode requests is the appropriate control because obfuscated URL attacks rely on encoding sequences (e.g., %u002f, double-encoding) to evade static pattern filters on the server. An IDS inspects decoded request payloads and can flag suspicious encoding patterns before or after they reach the web server, providing detection coverage that the web server itself may miss.

SSL/TLS authentication encrypts the channel and verifies identity but performs no inspection of URL encoding patterns or malicious payload content.

Active Scripts Detection targets scripting-based attack vectors and does not specifically identify or block Unicode or hex URL obfuscation techniques.