An identifier can mislead
06A visually persuasive URI can contain an authority different from the one a reader expects.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7.6 ↗
RFC 3986 · § 7.6EXAMPLE
4 / 4
04
Make the destination unambiguous.
Prefer a presentation that distinguishes host, userinfo, and path.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Show the parsed destination clearly.
- Userinfo can be constructed to resemble a trusted domain while the host names a different destination.
- Untrusted URI text must be handled according to the relevant scheme and application security rules.
- Generic URI syntax does not itself define a browser-origin policy or prove a resource is trustworthy.
The examples simplify the wire representation. Follow the linked specification and application profile for implementation.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy