It seems like the stanford.edu servers do not decode the hex in that URI before they check with the username, they do decode it later, you can see the headers. They could be using a CDN that decodes the URI and sends those headers, but they themselves may not decode it.
According to the URI specification (RFC3986) Section 2.1:
2.1. Percent-Encoding
A percent-encoding mechanism is used to represent a data octet in a
component when that octet's corresponding character is outside the
allowed set or is being used as a delimiter of, or within, the
component. A percent-encoded octet is encoded as a character
triplet, consisting of the percent character "%" followed by the two
hexadecimal digits representing that octet's numeric value. For
example, "%20" is the percent-encoding for the binary octet
"00100000" (ABNF: %x20), which in US-ASCII corresponds to the space
character (SP). Section 2.4 describes when percent-encoding and
decoding is applied.
pct-encoded = "%" HEXDIG HEXDIG
The uppercase hexadecimal digits 'A' through 'F' are equivalent to
the lowercase digits 'a' through 'f', respectively. If two URIs
differ only in the case of hexadecimal digits used in percent-encoded
octets, they are equivalent. For consistency, URI producers and
normalizers should use uppercase hexadecimal digits for all percent-
encodings.
and Section 2.4:
For example, the octet
corresponding to the tilde ("~") character is often encoded as "%7E"
by older URI processing implementations; the "%7E" can be replaced by
"~" without changing its interpretation.
- The URL containing
%7E
at the start does not seem to be invalid. - It seems too common that
~
is encoded as%7E
.
Since stanford.edu's Server:
header says that they are using Apache
: mod_userdir
in Apache seems to run before the URI is decoded. I have tested this, and this doesn't happen with the latest version.
Apart from that, the URL seems to be encoded by markdown (as mentioned in the comments).
For me, it only happens with Firefox, not with Chrome.
Fun fact: I was actually working with URL encoding/decoding in my own HTTP server when I saw this issue.