Defining Well-Known Uniform Resource Identifiers (URIs)
Extracted elements (14)
Per-directory well-known locations (e.g., '/images/.well-known/') were not defined because they would increase collision risk with pre-existing URIs and tend not to scale well due to being too 'chatty'.
The mechanism was created as a 'sandbox' for the already-common practice of designating well-known locations, reducing risks of collision between specifications and minimizing impingement upon sites' existing URI space.
The '/.well-known/' prefix was chosen because it is short, descriptive, and according to search indices, not widely used — minimizing collision risk with pre-existing URIs.
Well-known URIs are not intended for general information retrieval or establishing large URI namespaces, but specifically to facilitate discovery of site-wide policy or metadata when other mechanisms (HTTP headers, WebDAV PROPFIND) are impractical due to latency or deployment overhead.
This specification defines neither how to determine the authority to use for a particular context nor the scope of the metadata discovered by dereferencing the well-known URI; both must be defined by the application itself.
This specification does not define a format or media-type for the resource located at '/.well-known/' and clients should not expect a resource to exist at that location.
A well-known URI registration MAY contain additional information such as the syntax of additional path components, query strings, fragment identifiers, or protocol-specific details like HTTP method handling.
Applications that wish to mint new well-known URIs MUST register them, following the procedures in Section 5.1.
Registered well-known URI names MUST conform to the segment-nz production in RFC 3986.
A well-known URI is a URI whose path component begins with '/.well-known/', and whose scheme is 'http', 'https', or another scheme that has explicitly been specified to use well-known URIs.
The Well-Known URI registration template requires: URI suffix (the name relative to '/.well-known/'), change controller, specification document(s), and optionally related information.
This document establishes the Well-Known URI Registry. Registrations require Specification Required review, with requests sent to wellknown-uri-review@ietf.org; Designated Experts must approve or deny within 14 days.
Applications using well-known URIs must consider exposure of sensitive data, denial-of-service attacks, server and client authentication, DNS rebinding attacks, and attacks where limited server access grants the ability to affect how well-known URIs are served.
This memo does not specify the scope of applicability of metadata or policy obtained from a well-known URI, nor how to discover a well-known URI for a particular application; individual applications must define both aspects.