Uniform Resource Locator

Uniform Resource Locator
Name	Uniform Resource Locator
Abbreviation	URL
Introduced	1994
Inventor	Tim Berners-Lee
Purpose	Resource addressing on the World Wide Web
Related	Uniform Resource Identifier, Internationalized Resource Identifier, Domain Name System

Uniform Resource Locator

A Uniform Resource Locator is the addressing syntax used to locate resources on the World Wide Web and related Internet systems. It functions within the architecture of the World Wide Web, integrates with the Domain Name System and HTTP family of protocols, and is implemented across browsers, servers, and content-management systems worldwide. Adoption of the URL concept intersects with developments at CERN, W3C, IETF, and major technology vendors.

Overview

URLs are a subset of the broader Uniform Resource Identifier specification developed by standards bodies such as the World Wide Web Consortium and the Internet Engineering Task Force. URLs encode access method, authority, path, query and fragment components which interact with services like Hypertext Transfer Protocol, File Transfer Protocol, Secure Sockets Layer, Transport Layer Security and platform software including Apache HTTP Server, Nginx, Microsoft IIS, Google Chrome, Mozilla Firefox, Apple Safari, Opera and Internet Explorer. URLs enable interoperability among systems built by organizations such as CERN, MIT, National Institute of Standards and Technology, Oracle Corporation, Microsoft Corporation and Google LLC. Use of URLs is integral to services provided by Wikipedia, GitHub, Amazon, Facebook, Twitter, YouTube, LinkedIn, Dropbox, Stack Overflow, Reddit, PayPal, eBay, Bing and Yahoo!.

History and development

The conceptual work underlying URLs dates to proposals from researchers at CERN, notably Tim Berners-Lee, and to early hypertext projects at Xerox PARC, Stanford University, University of California, Berkeley, Massachusetts Institute of Technology, and DARPA. Early deployment involved collaborations with developers of NCSA Mosaic, WorldWideWeb, libwww, Gopher and early FTP and SMTP implementations. Standardization progressed through IETF working groups such as the URL (Uniform Resource Locator) discussions and W3C technical reports, influenced by institutions including European Organization for Nuclear Research, Internet Society, ICANN, IAB, IESG and national registries like RIPE NCC, ARIN, APNIC and LACNIC. Commercialization and scaling involved corporations such as Netscape Communications Corporation, Sun Microsystems, IBM, HP, Cisco Systems, AT&T, Verizon Communications, AOL, Comcast, Verizon, BT Group and cloud providers like Amazon Web Services, Microsoft Azure, Google Cloud Platform, Cloudflare, Akamai Technologies.

Syntax and components

A URL’s textual form comprises schemes, authority, path, query, and fragment. Scheme registries maintained by the Internet Assigned Numbers Authority and IETF include entries for ftp, http, https, mailto, file, data, ssh, telnet, ws and wss. The authority component references identifiers in the Domain Name System administered by entities such as ICANN and national registries, and may include userinfo and port numbers recognized by RFC 3986. Path segments map to resources hosted on servers run by projects and vendors like WordPress, Drupal, Joomla!, Django, Ruby on Rails, Node.js, Express, Spring Framework, Laravel, Apache Tomcat, NGINX Unit, Kubernetes, Docker, Heroku and Netlify. Query strings and form-encoded data interface with back-end systems built on MySQL, PostgreSQL, MongoDB, Redis, Elasticsearch and SQLite. Fragment identifiers interact with client-side technologies such as HTML5, CSS, JavaScript, React, Angular, Vue.js, WebAssembly, AJAX, jQuery.

Resolution and usage

Resolving a URL involves translation through the Domain Name System to an IP address followed by protocol-specific negotiations with servers operated by entities like Amazon Web Services, Google LLC, Microsoft Corporation, telecom carriers including Verizon Communications and AT&T, and content-delivery networks such as Cloudflare and Akamai Technologies. Client software including curl, wget, web browsers and mobile apps implement URL handling and follow standards produced by IETF and W3C. URLs are used in hyperlinking across platforms like Wikipedia, Wikimedia Foundation, GitHub, Stack Exchange, Medium, New York Times, BBC, The Guardian, CNN, Al Jazeera, Reuters, Bloomberg, The Washington Post, in addition to enterprise systems at SAP, Oracle Corporation, Salesforce, ServiceNow and Workday. APIs exposed by Twitter, Facebook, GitHub, Stripe, PayPal, Google APIs and Amazon API Gateway rely on URL patterns for routing.

Security and privacy considerations

URLs can carry sensitive data in userinfo and query components, attracting scrutiny from privacy regulators such as the European Commission, Federal Trade Commission, Information Commissioner's Office, CNIL and Office of the Privacy Commissioner of Canada. Threats include phishing campaigns associated with actors investigated by law enforcement agencies like FBI, Europol, Interpol and NCA; credential harvesting seen in incidents involving companies like Yahoo!, Equifax, LinkedIn and Facebook; and cross-site scripting and injection vectors targeted in advisories by CERT Coordination Center, US-CERT, ENISA, CISA and vendors such as Microsoft Security Response Center, Google Project Zero, Trend Micro, Kaspersky Lab and Symantec. Mitigations involve Transport Layer Security, HTTP Strict Transport Security, content-security policies endorsed by W3C, same-origin policy implementations in Google Chrome, Mozilla Firefox and Apple Safari, input validation libraries, secure design practices promoted by OWASP, and legal frameworks including the General Data Protection Regulation and California Consumer Privacy Act.

Standardization and related protocols

Specification work spans RFC 3986, RFC 3987, W3C recommendations on URIs and internationalization efforts including Internationalized Domain Names coordinated by ICANN and the Unicode Consortium. Related protocols and standards include HTTP/1.1, HTTP/2, HTTP/3, TLS, FTP, SFTP, SSH, SMTP, DNSSEC, DoH, DoT, WebDAV, OAuth 2.0, OpenID Connect, JSON-LD, Microformats, Schema.org and APIs standards fostered by OpenAPI Initiative and IETF working groups. Implementations appear across operating systems by Microsoft Windows, macOS, Linux, Android and iOS, and are adopted in web-scale platforms such as Facebook, Google LLC, Amazon and Apple Inc..

Category:Internet standards