URL
The address format that names every resource on the web, its parts from scheme to fragment, and why parsing one correctly is harder and more security-relevant than it looks.
A URL (Uniform Resource Locator) is the address of a resource on the web. It packs several decisions into one string: which protocol to use, which machine to ask, and what to ask it for. Tim Berners-Lee's design for the World Wide Web needed a way to point at any document on any server, and the URL is that pointer.
Take https://example.com:8443/docs/guide?lang=en#install. Its parts:
- Scheme.
httpsnames the protocol. Others includemailto,file, anddata. - Host.
example.comis looked up through the Domain Name System to find a machine. - Port.
8443picks a service on that machine; see Port. Each scheme has a default, 443 forhttps, so it's usually omitted. - Path.
/docs/guidenames a resource on the server. It looks like a filesystem path, and early servers mapped it straight to files, but a modern server can route it anywhere. - Query string.
?lang=enpasses key-value parameters, often to filter or search. - Fragment.
#installpoints within the page. The browser never sends it to the server, which is why early single-page apps used it for routing; see Single-Page Application.
The scheme, host, and port together form the origin, the unit of trust for the Same-Origin Policy.
URLs are restricted to a small set of ASCII characters. Anything else, such as spaces, & inside a value, or non-English text, is percent-encoded as bytes in hexadecimal, so a space becomes %20 and é becomes %C3%A9, its UTF-8 bytes; see Character Encoding. Non-ASCII domain names use a separate scheme called Punycode, which allows lookalike-character spoofing, such as a Cyrillic а standing in for a Latin a.
URI is the broader term for any identifier with this syntax, including names that don't say where to fetch anything. In practice the words are used interchangeably.
Parsing is harder than it looks. The IETF's generic syntax (RFC 3986) and the WHATWG URL Standard that browsers follow disagree on edge cases such as backslashes, extra slashes, and embedded credentials. When a server-side validator and the code that actually fetches a URL parse it differently, attackers can slip past allow-lists, a common route to open redirects and requests to internal services. The safe pattern is to parse once with a standard library and check the parsed host, never the raw string.
URLs are also an interface. People read them, share them, and bookmark them, so a URL is a promise that the resource will stay there. Breaking that promise is Link Rot. Clean, stable, readable paths help both users and search engines; see Search Engine Optimization. Encoding application state in the URL, such as filters and the current page, makes views shareable and keeps the back button working.
See also3
Canonical URL
The one preferred address for a page that's reachable at many, declared so search engines and other tools treat the copies as a single page, a hint introduced by the major search engines together in 2009.
Data & Content10 connections
Deep Linking
Linking straight to a specific page or item rather than a site's front door, once fought over in court and now a feature that apps and web apps must work to support.
Web Platform10 connections
Data URI
A URL that carries its content inside the address itself, used to embed small images in pages and stylesheets without a separate request, and abused for phishing until browsers restricted it.
Web Platform13 connections
Linked from16
- Base64Data & Content
A way to write arbitrary bytes using 64 safe text characters, so binary data can travel through email, JSON, URLs, and other channels built for text, at the cost of a third more size and with no secrecy at all.
- Canonical URLData & Content
The one preferred address for a page that's reachable at many, declared so search engines and other tools treat the copies as a single page, a hint introduced by the major search engines together in 2009.
- Data URIWeb Platform
A URL that carries its content inside the address itself, used to embed small images in pages and stylesheets without a separate request, and abused for phishing until browsers restricted it.
- Deep LinkingWeb Platform
Linking straight to a specific page or item rather than a site's front door, once fought over in court and now a feature that apps and web apps must work to support.
- HotlinkingWeb Platform
Displaying an image or file on your page straight from someone else's server, so they pay for the traffic, which sites block by checking where requests come from and which courts have treated differently from copying.
- Internationalized Domain NameWeb Platform
Domain names written in non-Latin scripts and accented letters, made to work in an ASCII-only DNS by encoding them as xn-- strings, and the browser rules that decide when to show the real characters and when to show the code to block lookalike attacks.
- Open GraphWeb Platform
The meta tags a page uses to describe its own preview card when a link is shared, how chat apps and social networks fetch them, and why a preview shows only what the page claims about itself.
- Open RedirectWeb Platform
A page that forwards visitors to whatever address a URL parameter names, letting attackers borrow a trusted domain to launch phishing or steal sign-in tokens, and the narrow ways to fix it.
- PortSystems & Tooling
The numeric endpoint a network service listens on, and a scarce shared resource on a developer machine.
- Prototype PollutionWeb Platform
A JavaScript vulnerability where attacker-controlled keys like "__proto__" modify the prototype every object inherits from, silently adding properties everywhere, and how merge utilities and parsers let it in.
- Referrer PolicyWeb Platform
The rules for when a browser tells a site which page a visitor came from, a header misspelled in the 1990s that leaked private addresses for decades until browsers began trimming it by default.
- Single-Page ApplicationWeb Platform
A web app that loads one HTML page and then rewrites it with JavaScript as the user navigates, trading a slower, heavier first load for app-like transitions afterwards.
- SlugData & Content
The short, readable, hyphenated part of a URL that names a page, borrowed from newsroom jargon, simple to generate and surprisingly hard to keep stable once other people link to it.
- State ManagementWeb Platform
How a front-end application keeps track of the data that changes as people use it, and decides where each piece lives, from local component state to global stores to server caches.
- Top-Level DomainNetworks & Distribution
The last part of a domain name, such as .com or .uk, organized in 1984 into a handful of generic names plus one per country, then opened to over a thousand new names and a source of income for some small nations.
- Web CrawlerWeb Platform
A program that discovers the web by fetching pages and following their links, the machinery behind search engines and training datasets, and the voluntary etiquette that governs it.