1

I'm writing a Javascript driven one-page application where the URL contains a # param eg. (example.com/#foo/bar) to represent application state (I've considered using various JS frameworks but cannot, due to various reasons).

Sometimes, the hash may have a space (or many spaces) in it. Eg. example.com/#foo/bar bar2.

  1. Is this safe?
  2. Are there any other characters that shouldn't be used in the hash portion?

This question addresses the question of spaces in the URL portion and recommends escaping spaces. But since changing the fragment after the # doesn't result in a new HTTP request, do those rules apply?

Community
  • 1
  • 1
Jay
  • 3,471
  • 4
  • 35
  • 49
  • Fair point. Apart from SEO, does it matter if there's no exclamation point after the #, for what I'm asking? – Jay Oct 02 '12 at 21:35

1 Answers1

3

I'm going to sidestep the question of what is safe and simply state that whitespace in the URL is illegal per section 2.4.3 of RFC 2396. Doing illegal things means that you cannot really predict what software will do when it encounters such a URI.

Besides, if JavaScript is involved you probably don't want to guarantee that changing that hash of a URL doesn't trigger an XHR and cause network activity that re-parses the URL. (For example, you may decide you want to mess with history state or do some analytical tracking onhashchange.)

kojiro
  • 74,557
  • 19
  • 143
  • 201
  • So for the purposes of RFC 2396 even the fragment-identifier is considered part of the URI? – Jay Oct 02 '12 at 21:36
  • 1
    @Jayraj yes, see section 4 of the same spec. – kojiro Oct 02 '12 at 21:42
  • 1
    @kojiro section 4.1 actually states `As such, it is not part of a URI` but adds `character restrictions described in Section 2 for URI also apply to the fragment`. – lapo Jan 15 '16 at 08:13