Evaluate claims before trusting or following
06A valid Link field is still an assertion. Decide whether its publisher can speak for its context and whether following its target is appropriate.
In a separate follow decision the target is untrusted.example/terms. This application does not allow the automatic GET, so no request, cookies or Referer is sent. HTTPS alone would not make the decision safe.
Source for this drawing: RFC 8288 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Dereference
- Access a resource identified by a URI.
- Authority
- The host/port part of a URI; sharing one can be relevant to a chosen trust policy.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Link fields are not inherently private, integrity-protected or trustworthy. HTTPS protects transport; it does not prove the publisher’s assertions about another resource.
- Link fields are not inherently private, integrity-protected or trustworthy. HTTPS protects transport; it does not prove the publisher’s assertions about another resource.
- A third-party anchor assertion cannot simply be trusted. An application can mitigate this by discarding it unless an appropriate relationship between resources is established, for example a shared authority.
- Automatic dereferencing can expose state through Referer and cookies. Applications ought to define careful follow, credential and privacy policies; parsing does not authorize a request.
- Extension-relation documentation is not automatically fetched (SHOULD NOT). A link does not grant permission, promise availability or prove that the target’s contents are safe.
Fictional response from https://untrusted.example/report claims copyright terms for https://trusted.example/book by using anchor. This example application requires a recognized relationship before trusting a third-party context claim; its check fails. That is a chosen policy, not a universal same-origin MUST in RFC 8288. The last step is a separate automatic-follow policy check: no GET, cookies or Referer is sent when the application blocks following.
Read the RFC section ↗