Section 4 (URI References) was added specifically to resolve confusion about whether fragment identifiers are part of a URI. Fragments are syntactically associated with URI references but are not part of the URI itself; their semantics depend on the retrieved media type.

The slash '/' was treated as part of the path component (not as a separator between authority and path) because it proved impossible to accurately distinguish '<foo:/bar>' from '<foo:bar>' under the prior RFC 1738/1808 model where the slash was carried as a prefix.

The URI character set was restricted to digits, basic Latin letters, and a small set of graphic symbols to enable global transcribability across different media (paper, radio, computer input) and keyboard layouts. The ability to transcribe identifiers was considered more important than using maximally meaningful component names.

The 'user:password' form from RFC 1738 was replaced by a generic 'userinfo' token and the password made scheme-specific, removing even the syntactic suggestion that clear-text passwords belong in URIs.

security

Due to a loophole in RFC 1630, some parsers allow the same scheme name to appear in a relative URI reference. Validating parsers should mark such references as errors; for backwards compatibility, an implementation may strip the scheme if it matches the base URI and is known to use hier_part syntax.

Literal IPv6 addresses are not supported as the host part of a URL in this specification; a suitable representation was desired but had not been determined or implemented in practice at time of publication.

Scheme and hostname are case insensitive for equivalence purposes; a URL with an explicit ':port' equal to the scheme default is equivalent to one where the port is omitted. Scheme-specific normalization algorithms may additionally permit unescaping of unreserved characters.

Some WWW client implementations fail to separate the reference's query component from its path before merging with the base path in step 6 of relative resolution, which may cause loss of information if the query contains '/../' or '/./'.

Data conflicting with a component's reserved characters must be escaped before forming the URI. The percent character '%' must itself be escaped as '%25' when used as data.

Data corresponding to excluded US-ASCII characters (controls 00-1F and 7F, space, '<', '>', '#', '%', '"', and 'unwise' characters) must be escaped in order to be properly represented within a URI.

Implementations should not escape or unescape the same string more than once, since unescaping an already-unescaped string may misinterpret a literal percent as an escape prefix, and vice versa.

It is the responsibility of the distributor(s) of a document containing relative URIs to ensure that the base URI for that document can be established. Relative URI cannot be used reliably when the document's base URI is not well-defined.

Programs interpreting URI SHOULD treat upper-case letters as equivalent to lower case in scheme names (e.g., accept 'HTTP' as equivalent to 'http') for resiliency.

The use of a password within the userinfo component of a URL is NOT RECOMMENDED because passing authentication information in clear text has proven to be a security risk in almost every case where it has been used.

security

When a URI is being parsed, the greedy (left-most) algorithm is used to disambiguate an authority component from a path beginning with two slash characters; the authority component wins.

A fragment identifier is separated from the URI by '#' and consists of *uric characters. It is not part of the URI itself; its interpretation is a property of the media type of the retrieval result.

A URI-reference is defined as an optional absolute or relative URI followed by an optional fragment identifier separated by '#'. The four main components of an absolute hierarchical URI are scheme, authority, path, and query, written as <scheme>://<authority><path>?<query>.

Base URI precedence is determined in four layers (innermost wins): (1) base URI embedded in document content; (2) base URI of the encapsulating entity; (3) URI used to retrieve the entity (using the last URI after redirects); (4) application-defined default base URI.

Reserved characters are ';', '/', '?', ':', '@', '&', '=', '+', '$', ','. They are allowed in a URI but may not be used as data within a particular component without escaping, as they serve as component delimiters.

The authority component takes the form server | reg_name, is preceded by '//', and is terminated by the next '/', '?', or end of URI. The server form is [ [ userinfo '@' ] hostport ] where userinfo may carry authentication information.

The path component contains path_segments separated by '/', where each segment may include semicolon-delimited parameters. The path and opaque_part are mutually exclusive for any given URI and treated as a single component by parsers.

The scheme component must begin with an alpha character and may be followed by any combination of lower-case letters, digits, plus, period, or hyphen: scheme = alpha *( alpha | digit | '+' | '-' | '.' ).

The server-based naming authority uses the syntax <userinfo>@<host>:<port>. The host is either a hostname (dot-separated domain labels) or an IPv4address (four dot-separated decimal digit groups); literal IPv6 addresses are not supported.

Unreserved characters are alphanum | mark, where mark = '-' | '_' | '.' | '!' | '~' | '*' | '\'' | '(' | ')'. These characters can be escaped without changing URI semantics, but escaping should be avoided unless required by context.

A URL specifying a non-default port number may cause a client to contact a server running a different protocol, and URL content interpreted by that protocol may trigger unexpected or damaging remote operations. Caution is advised especially for port numbers within the reserved space.

security

Escaped delimiters significant to a given protocol (e.g., CR and LF for telnet) must not be unescaped before transmission, to avoid simulating extra operations or parameters that could lead to unintended remote actions.

security

There is no guarantee that a URL will continue to locate the same resource, nor that it will not locate a different resource later, due to the lack of constraints on how an authority apportions its namespace.

security

Use of a password within the userinfo component of a URL is strongly disrecommended except in the rare case where the password is intended to be public, because clear-text credentials in URI have proven a security risk in nearly every use case.

security

Relative URI resolution proceeds in 7 ordered steps: (1) parse reference into components; (2) if all components empty/undefined, reference is current document; (3) if scheme is defined, use as absolute URI; (4) inherit authority from base if undefined; (5) if path starts with '/', use as absolute path; (6) merge relative path with base path using dot-segment removal algorithm; (7) recombine components into absolute URI.

An escaped octet is encoded as a triplet: the percent character '%' followed by exactly two hexadecimal digits representing the octet value, e.g., '%20' for US-ASCII space. escaped = '%' hex hex.