RFC 3986

RFC 3986
Title	RFC 3986
Type	Request for Comments
Number	3986
Status	Standard
Year	2005
Authors	Tim Berners-Lee; Roy Fielding; Larry Masinter

RFC 3986 RFC 3986 is the Internet Engineering Task Force (IETF) standard that defines the generic syntax for Uniform Resource Identifiers (URI), unifying earlier proposals and providing normative rules for parsing, comparing, and normalizing identifiers used across World Wide Web technologies and network protocols. The document specifies the hierarchical and component-based structure of URIs to enable interoperability among implementations in Mozilla, Google, Microsoft, Apple Inc., and other organizations building web infrastructure. RFC 3986 influences standards work at bodies such as the Internet Engineering Task Force, the Internet Architecture Board, and the European Telecommunications Standards Institute.

Overview

RFC 3986 defines URIs as compact strings of characters used to identify resources and prescribes a generic syntax applicable to schemes such as http, https, ftp, mailto, and file. The specification separates a URI into components including scheme, authority, path, query, and fragment to support consistent processing by software from projects like Apache HTTP Server, Nginx, Node.js, Django and libraries developed by Oracle Corporation and IBM. It builds on earlier work in the IETF community including RFCs authored by contributors affiliated with institutions such as MIT, Xerox PARC, and the University of California, Irvine.

Syntax and Components

RFC 3986 formalizes ABNF production rules for URI syntax using mechanisms familiar to authors from Internet Engineering Task Force documents and grammars used in languages from ISO/IEC standards. The main components—scheme, authority (userinfo, host, port), path, query, and fragment—map to implementation concerns in Apache Tomcat, Lighttpd, and client libraries like libcurl and OkHttp. The authority component references hostnames and IP literals, invoking name resolution systems such as Domain Name System and registries overseen by ICANN. Path syntax supports hierarchical resource models found in projects like REST architectures and web frameworks including Ruby on Rails and Express.

Character Encoding and Percent-Encoding

The specification prescribes percent-encoding for octet values outside the set of unreserved characters, an approach used by standards implementers at World Wide Web Consortium and in libraries like OpenSSL and GnuTLS. RFC 3986 distinguishes unreserved characters from reserved characters to avoid ambiguities in contexts such as query strings and fragment identifiers used by HTML documents and JavaScript single-page applications maintained by teams at Facebook and Netflix. The rules interact with character encodings standardized by Unicode, ISO/IEC 10646, and UTF-8, affecting internationalized resource handling in projects like Internationalized Domain Names and platform vendors including Canonical Ltd. and Red Hat.

URI Comparison and Normalization

RFC 3986 defines normative steps for normalization and equivalence testing—including case normalization, percent-encoding normalization, and path segment normalization—practices adopted by search and indexing systems at Yahoo!, Bing, and DuckDuckGo. Normalization supports canonicalization used by OAuth implementations, OpenID Connect, and content distribution systems run by Akamai Technologies and Cloudflare. Comparison rules address host case insensitivity and percent-encoding semantics, informing security policies in Google Chrome, Mozilla Firefox, and enterprise proxies from F5 Networks.

Security Considerations

RFC 3986 highlights ambiguity and parsing differences that can lead to security vulnerabilities such as request smuggling, open redirect, and directory traversal attacks examined by researchers affiliated with MITRE and OWASP. The document's guidance influences mitigations in web servers like Microsoft IIS and reverse proxies used by Amazon Web Services and Google Cloud Platform. Implementers in the IETF HTTP Working Group and security teams at Cisco Systems leverage RFC 3986 when designing input validation, normalization, and canonicalization strategies to reduce exploitation risks in applications from WordPress and Joomla.

Implementation and Adoption

RFC 3986 is widely implemented across client and server software stacks, language standard libraries for Python, Java, C#, Go, and ecosystems such as npm and Maven Central. Content management systems and APIs used by Salesforce, SAP, and government platforms in European Union member states follow URI rules when constructing and validating resource identifiers. Major standards and specifications from the World Wide Web Consortium and IETF reference RFC 3986 for canonical URI behavior in protocols like HTTP/1.1, HTTP/2, and S/MIME.

History and Revisions

RFC 3986, published in January 2005, obsoleted earlier RFCs that traced lineage through authors and working groups connected to institutions like CNRI and Bell Labs. Successive errata and updates from the IETF community led to later clarifications and related documents addressing Internationalized Resource Identifiers and normalization practices referenced by projects such as WHATWG and subsequent RFCs produced by contributors from University of Southern California and commercial entities including Netscape Communications Corporation alumni. Ongoing standards work continues in relevant IETF working groups and liaison efforts with W3C to refine interoperability for evolving web architecture.

Category:Internet standards