I think you are misunderstanding the question. No matter which characters are included in ".urlHostAllowed", i would still end up with either "/" or "%252F" (i.e. not encoded at all or encoded twice) because URLQueryItem encodes some (seemingly undocumented and not customizable) set of characters but not "/".