This document was written by the URI working group of the Internet Engineering Task Force. Comments may be addressed to the editor, Tim Berners-Lee <firstname.lastname@example.org>, or to the URI-WG <email@example.com>. Discussions of the group are archived at
<http://www.acl.lanl.gov/URI/archive/uri-archive.index.html>This document is bound by the Requirements Specification in preparation.
The work is derived from concepts introduced by the World-Wide Web global information initiative, whose use of such objects dates from 1990 and is described in "Universal Resource identifeirs for the World-Wide Web", RFCXXX .
This document is available in hypertext form, with links to background information, as:
Internet Drafts are working documents valid for a maximum of six months. Internet Drafts may be updated, replaced, or obsoleted by other documents at any time. It is not appropriate to use Internet Drafts as reference material or to cite them other than as a "working draft" or "work in progress".
Distribution of this document is unlimited.
The syntax is described in two parts. Firstly, we give the syntax rules of a completely specified name; secondly, we give the rules under which parts of the name may be omitted in a well-defined context.
Any mapping scheme may be defined provided it is unambiguous, reversible, and provides valid URLs. It is recommended that where hierarchical aspects to the local naming scheme exist, they be mapped onto the hierarchical URL path syntax in order to allow the partial form to be used.
The following encoding method shall be used for mapping WAIS, FTP, Prospero and Gopher addresses onto URLs. Where the local naming scheme uses octet values which are not allowed in the URL, these shall be represented in the URL by a percent sign "%" followed by two hexadecimal digits (0-9, A-F) giving the value for that octet. This specification makes no assumptions or requirements about the character sets, if any, referred to be the (decoded) octets a URL. Character codes other than those allowed by the syntax shall not be used unencoded in a URL.
The same encoding method may be used for encoding characters whose use, although technically allowed in a URL, would be unwise due to problems of corruption by imperfect gateways or misrepresentation due to the use of variant character sets, or which would simply be awkward in a given environment. Because a % sign always indicates an encoded character, a URL may be made safer simply by encoding any characters considered unsafe, while leaving already encoded characters still encoded. Similarly, in cases where a larger set of characters is acceptable, % signs can be selectively and reversibly expanded.
The reserved characters shall however never be arbitrarly encoded and decoded.
New schemes may be registered at a later time.
Where possible, this mail address should correspond to a usable mail address for the user, and preferably give a DNS host name which resolves to the IP address of the client. Note that servers currently vary in their treatment of the anonymous password.
The arguments of any CWD commands are successive segment parts of the URL delimited by slash, and the final segment is suitable as the filename argument to the RETR command for retrieval or the directory argument to NLIST.
For some file systems (Unix in particular), the "/" used to denote the hierarchical structure of the URL corresponds to the delimiter used to construct a file name hierarchy, and thus, the filename will look the same as the URL path. This does NOT mean that the URL is a Unix filename.
An FTP URL may optionally specify the FTP data transfer type by which an object is to be retrieved. Most of the methods correspond to the FTP "Data Types" ASCII and IMAGE for the retrieval of a document, as specified in FTP by the TYPE command . One method indicates directory access.
The data type is specified by a suffix to the URL. Possible suffixes are:
The host details are not passed on to the client when the URL is an http URL which refers to the server in question. In this case the string sent starts with the slash which follows the host details. However, when an http server is being used as a gateway (or "proxy") then the entire URI, whether HTTP or some other scheme, is passed on the HTTP command line.The search part, if present, is sent as part of the HTTP command, and may in this respect be treated as part of the path.No fragmentid part of a WWW URI (the hash sign and following) is sent with the request. Spaces and control characters in URLs must be escaped for transmission in HTTP, as must other disallowed characters.
Note that slash "/" in gopher selector strings may not correspond to a level in a hierarchical structure.
The format of a gopher URL is:
a_gopher_selector<tab>+<cr><lf>to the gopher+ server.
Note that items which have a +ASK asssociated with them (ie. Gopher+ items tagged with a "?") require the client to fetch the item's +ASK attribute to get the form definition, and then ask the user to fill out the form and return the user's responces along with the selector string to retrieve the item. Gopher+ clients know how to do this but depend on the "?" tag in the gopher+ item description to know when to handle this case. The "?" is used in the Gopher+ string to be consistent with Gopher+ protocol's use of this symbol.
To refer to the Gopher+ attributes of an item, the Gopher+ string shall consist of "!" or "$". "!" refers to the all of a gopher+ item's attributes. "$" refers to all the item attributes for all items in a Gopher directory. To retrieve an item or directory's attributes, a gopher client will send:
a_gopher_selector<tab>!<cr><lf>for items or
a_gopher_selector<tab>$<cr><lf>for directories to the gopher+ server.
To refer to specific attributes, the Gopher+ string is "!attribute_name" or "$attribute_name". For example, to refer to the attribute containing the abstract of an item, the Gopher+ string would be "!+ABSTRACT". To refer to several attributes, clients send the server the attribute names seperated by spaces so it is neccesary to seperate the attribute names with coded spaces. To retrieve a collection of item attributes specified with a gopher+ string of "!+ABSTRACT%20+SMELL" a gopher client would send
a_gopher_selector<tab>!+ABSTRACT +SMELL<cr><lf>to the gopher server.
Gopher+ allows for optional alternate data representations (alternate views) of items. To retrieve a Gopher+ alternate view, the gopher+ client sends the appropriate view and language identifier (found in the item's +VIEW attribute). To refer to a specific Gopher+ alternate view, the URL's Gopher+ string would be in the form "+view_name%20language_name". For example, a gopher+ string of "+application/postscript%20Es_ES" refers to the spanish language postscript alternate view of a gopher+ item. To retrieve this alternate view the client would send
a_gopher_selector<tab>+application/postscript Es_ES<cr><lf>to the gopher server.
The gopher+ string for a URL that refers to an item referenced by an ASK form filled out with specific values is essentially a coded version of what the client sends to the server. The gopher+ string will be of the form
+%091%0D%0A+-1%0D%0Aask_item1_value%0D%0Aask_item2_value%0D%0A.%0D%0ATo retrieve this item, the gopher client sends:
a_gopher_selector<tab>+<tab>1<cr><lf> +-1<cr><lf> ask_item1_value<cr><lf> ask_item2_value<cr><lf> .<cr><lf>to the gopher server.
For a really complex example, consider a URL that refers to an alternate view of an item that is referenced with a filled-out Gopher +ASK form. The gopher+ string will be of the form:
+view_name%20language_name%091%0D%0A+-1%0D%0Aask_item1_value%0D%0A ask_item2_value%0D%0A.%0D%0ATo retrieve this item, the gopher client sends:
a_gopher_selector<tab>+view_name language_name<tab>1<cr><lf> +-1<cr><lf> ask_item1_value<cr><lf> ask_item2_value<cr><lf> .<cr><lf>to the gopher server.
%3FTo refer to all or specific attributes of a gopher item:
![attribute_name][%20attribute_name][%20attribute_name]...To refer to all or specific attributes of a gopher directory:
$[attribute_name][%20attribute_name][%20attribute_name]...To refer to the content of a gopher+ item (including an item referred to by specific values in a filled-out ASK form):
gopher://host [port]/0a_gopher_selectorAn example of a URL pointing to a gopher type 7 item (a search engine) where the string foobar is to be submitted to the search engine is:
gopher://host [port]/7a_gopher_selector%09foobarAn example of a URL pointing to a Gopher+ type 0 item (a document) is:
gopher://host [port]/0a_gopher_selector%09%09some_gplus_stuffAn example of a URL pointing to a Gopher+ type 0 (document) item's attribute information is:
gopher://host [port]/0a_gopher_selector%09%09!An example of a URL pointing to a Gopher+ document's spanish postscript representation is:
A news URL may be dereferenced using NNTP (RFC977, Kantor 86) (The ARTICLE by message-id command ) or using any other protocol for the conveyance of usenet news articles, or by reference to a body of news articles already received.
The news server name, newsgroup name, and index number of an article within the newsgroup on that particular server are given. The NNTP protocol must be used.
This form or URL should not be quoted outside this local area. It should not be used within news articles for wider circulation than the one server. This is a local identifier for a resource which is often available globally, and so is not recommended except in the case in which incomplete NNTP implementations on the local server force its adoption.
The path part contains a host specific object name and an optional version number. If present, the version number is separated from the host specific object name by the characters "%00" (percent zero zero), this being an escaped string terminator (null). External Prospero links are represented as URLs of the underlying access method and are not represented as Prospero URLs.
The wpath of a WAIS URL consists of encoded fields of the WAIS identifier, in the same order as inthe WAIS identifier. For each field, the identifier field number is the digits before the equals sign, and the field contents follow, encoded in the conventional encoding, terminated by ";".
It is proposed that the Internet Assigned Numbers Authority (IANA) perform the function of registration of new schemes. Any submission of a new URI scheme must include a definition of an algorithm for the retrieval of any object within that scheme. The algorithm must take the URI and produce either a set of URL(s) which will lead to the desired object, or the object itself, in a well-defined or determinable format.
It is recommended that those proposing a new scheme demonstrate its utility and operability by the provision of a gateway which will provide images of objects in the new scheme for clients using an existing protocol. If the new scheme is not a locator scheme, then the properties of names in the new space should be clearly defined. It is likewise recommended that, where a protocol allows for retrieval by URL, that the client software have provision for being configured to use specific gateway locators for indirect access through new naming schemes.
The current IETF URI working group preference is for the prefixedurl production. (Nov 1993. July 93: url).
The "national" and "punctuation" characters do not appear in any productions and therefore may not appear in URLs.
The "afsaddress" is left in as historical note, but is not a url production
A URL-related security threat is that it is sometimes possible to construct a URL such that an attempt to perform a harmless idempotent operation such as the retrieval of the object will in fact cause a possibly damaging remote operation to occur. The unsafe URL is typically constructed by specifying a port number other than that reserved for the network protocol in question. The client unwittingly contacts a server which is in fact running a different protocol. The content of the URL contains instructions which when interpreted according to this other protocol cause an unexpected operation. (An example has been the use of gopher URLs to cause a rude message to be sent via a SMTP server). It is potentially harmful for client software use any URL which specifies a port number other than the default for the protocol, especially when it is a number within the reserved space.
Care should be taken when URLs contain embedded encoded delimiters for a given protocol (for example, CR and LF characters for telnet protocols) that these are not unencoded before transmission. This misimplementation of the specification would could violate the protocol but could without violating the protocol be used to simulate an extra operation or parameter, again causing an unexpected and possible harmful remote operation to be performed.
The use of URLs containing passwords is clearly unwise.
The draft url4 (Internet Draft 00) was generated from url3 following discussion and overall approval of the URL working group on 29 March 1993. The paper url3 had been generated from udi2 in the light of discussion at the UDI BOF meeting at the Boston IETF in July 1992. Draft url4 was Internet Draft 00. Draft url5 incorporated changes suggested by Clifford Neuman, and draft url6 (ID 01) incorporated character group changes and a few other fixes defined by the IETF URI WG in submitting it as a proposed standard. URL7 (Internet Draft 02) incorporated changes introduced at the Amsterdam IETF and refined in net discussion.
The draft 03 includes changes made at Houston in Nov 93, and on the net before Seattle March 1994.
URIs, including URLs, will ideally be transmitted though protocols which accept them and data formats which define a context for them. However, in practice nowadays there are many occasions when URLs are included in plain ASCII non-marked-up text such as electronic mail and usenet news messages.
In this case, it is convenient to have a separate wrapper syntax to define delimiters which will enable the human or automated reader to recognize that the URI is a URI.
The recommendation is that the angle brackets (less than and greater than signs) of the ASCII set be used for this purpose.
These wrappers do not form part of the URL, are not mandatory, and should not be used in contexts (such as SGML parameters, HTTP requests, etc) in which delimiters are already specified.
Yes, Jim, I found it under <ftp://ftp.w3.org/pub/www/doc> but you can probably pick it up from <ftp://ds.internic.net/rfc>.
Tim Berners-Lee Address: World-Wide Web project CERN, 1211 Geneva 23, Switzerland Telephone: +41 (22)767 3755 Fax: +41 (22)767 7155 Email: firstname.lastname@example.org