Resource regex escaping is a bit aggressive

[carlfreeland]

I'm writing a resource pattern for something including a path parameter, e.g. /api/v1/customers/28754/purchases. I had to use a hack because '+' is escaped. I ended up using /api/v1/customers/\d{1,16}/purchases because JS integer numbers cannot exceed 16 digits.

Can someone explain the reasoning behind escaping '+'? I suppose it was done because spaces in URLs get encoded as +, but it feels like the current magic behavior where the string is sort of a regular expression, but sort of not due to escaping and replacing some characters is harder to understand. I had to read the source code to understand why my regex wouldn't catch the parameter.

Using asterisk in this situation isn't desirable because it matches too broadly, allowing other paths to match when they shouldn't.

Thanks!

-Carl