28

Assume an absolute http or https URL. I'm looking for an "official" or generally accepted name for the part of the URL that comes before the path.

    http://foo:bar@example.com:8042/over/there?name=ferret#nose
    \_____________________________/
                  |
              this part

RFC 3986 defines the URL syntax parts as follows:

    http://foo:bar@example.com:8042/over/there?name=ferret#nose
    \__/   \______________________/\_________/ \_________/ \__/
      |               |                |            |        |
   scheme         authority           path        query   fragment

RFC 6454 defines the origin (as in "same origin") of an the URL as the triple (scheme, host, port):

    http://foo:bar@example.com:8042/over/there?name=ferret#nose
    \__/           \______________/
      \________________/
              |
           origin

As such, neither term is appropriate. Is there a good term for the part I'm looking at, or am I stuck with "scheme (plus ://) plus authority"?

Community
  • 1
  • 1
Søren Løvborg
  • 8,354
  • 2
  • 47
  • 40

2 Answers2

11

The name in practice and per the current URL standard for the part of a URL that comes before the path is in fact just origin.

The :// part of a URL is just a syntactic (or lexical?) artifact that there’s never any real need to mention in discussions about actual behavior of anything that consumes or processes URLs (other than low-level parsers of course).

The username-password part is a non-conforming misfeature that’s now only useful to discuss as a historical error. The relevant part of the current URL standard has this to say about it;

There is no conforming way to express a username or password of a URL record within a URL string.

So again in practice for any normal discussions of URLs that align with how the current standards define URLs, it’s sufficient to speak about a URL simply in terms of its highest-level parts being just four parts: its origin, its path, its query (part), and its fragment (part).

Certainly that is at least what the current URL standard itself limits it to.

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
  • Well, "origin" doesn't help as a term when something for a syntactical part is needed. (And also note that the deprecation of "userinfo" dates back to the, ahem, official URI specification) – Julian Reschke Sep 19 '15 at 06:38
  • Thanks for pointing me to the WhatWG URL standard. However, although I admire the goal of WhatWG, saying that URLs must not contain userinfo is not really an option in my case, and WhatWG still explicitly defines origin as excluding the username and password. – Søren Løvborg Sep 21 '15 at 08:56
1

It would have to just be "scheme plus authority". Bear in mind, that you can't have a valid URI that just has a scheme plus authority, so the combination doesn't come up much as a unit to discuss, and so didn't end up with a name.

Note also that userinfo has never been allowed in HTTP URIs; particular schemes can prohibit or restrict the values of particular portions. Some browsers had a design flaw where they would accept userinfo and base authentication headers on it, but most now will at least warn about this being done, if they allow it at all.

Jon Hanna
  • 110,372
  • 10
  • 146
  • 251
  • Huh, you're right. userinfo was not allowed in HTTP URLs until RFC7230 which (curiously) says it's "now" disallowed (although it really only strongly deprecates them). Anyway, HTTP exists outside of browsers, and userinfo is not quite dead yet. It does strengthen the case for using the term "origin", though. – Søren Løvborg Sep 22 '15 at 11:11
  • Outside of browsers, userinfo is even more strongly prohibited, while browsers had a design flaw that abused the userinfo portion, they turns them into real HTTP URIs before continuing. Other HTTP software won't do that. – Jon Hanna Sep 22 '15 at 13:04
  • 1
    Err, tell that to `curl`, `wget`, `hg`, `git`, and any number of more esoteric tools using HTTP. – Søren Løvborg Sep 22 '15 at 13:25
  • Okay, fair enough. They still aren't HTTP URIs though, and they still turn them into real HTTP URIs themselves. – Jon Hanna Sep 22 '15 at 14:01