URL

Two specifications govern URLs. RFC 3986 (January 2005, STD 66) defines generic URI syntax as scheme ":" hier-part, optionally followed by "?" query and "#" fragment, with the authority component written as optional userinfo "@", then host, then optional ":" port (§3.2). The WHATWG URL Standard is a living specification of what browsers actually do, including error-tolerant parsing of backslashes, stripped tabs and newlines, and unusual IPv4 notations such as 2130706433 or 0x7f.1 for 127.0.0.1. The first URL RFC was RFC 1738 (1994), following Tim Berners-Lee's work on the Web. In RFC 3986 terms a URL is a URI that also provides a means of locating the resource, but §1.1.3 notes that the URL/URN distinction is of little practical use.

Characters outside the unreserved set are percent-encoded as UTF-8 octets (§2.1), and the reserved gen-delims and sub-delims have structural meaning. Normalisation (§6) lowercases scheme and host and removes dot segments (§5.2.4), and relative references are resolved against a base URI by the algorithm in §5. The fragment is never sent to the server. The key=value&key=value convention of the query, including + for space, comes from HTML form encoding, not from RFC 3986. Internationalised domain names are converted to ASCII punycode labels with the xn-- prefix (RFC 3492) under IDNA2008 or UTS #46, and browsers show the Unicode form only when it passes confusable-character checks.

Most phishing tricks exploit the reader's parsing rather than the computer's. In https://login.bank.dk@evil.example/ everything before @ is userinfo and the host is evil.example; in bank.dk.evil.example the registrable domain, read from the right using the Public Suffix List, is evil.example; homographs replace a Latin letter with a look-alike Cyrillic one. On the server side, differences between the library that validates a URL and the one that fetches it enable SSRF and open-redirect bypasses, as Orange Tsai demonstrated at Black Hat 2017; open redirects are catalogued as CWE-601. Tokens or personal data in query strings leak through server logs, browser history and the Referer header, which Referrer-Policy limits. This leakage is one reason OAuth 2.0 security guidance discourages the implicit flow, which returned access tokens in the URL.

Safe handling means parsing with one well-tested library, comparing parsed components (an allowlisted scheme, an exact host) rather than matching substrings or regexes, rejecting javascript: and data: in user-supplied links to prevent XSS, and re-validating after redirects. No specification sets a maximum length; servers impose their own and answer with 414 URI Too Long.