Re: URI security

Larry Masinter ([email protected])
Sat, 29 Apr 1995 11:46:05 +0500

Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: Arthur van Hoff: "Re: your mail"
Previous message: [email protected]: "URLs in saved documents"
Maybe in reply to: Paul Phillips: "URI security"

> Upon whom does the responsibility lie for avoiding ".." in request
> pathnames? Would a server that rejects any URL request with ".." in it be
> non-compliant?

. is interpreted by the CLIENT in relative URLs and by the SERVER in
absolute URLs. That is, if you say

in a document whose base is "http://myserver/foo/bar.html", this is a
interpreted as "http://myserver/baz.html". However, if you say

this is an absolute URL and the ".." gets sent to the server, which
can interpret it however it wants.

The relative URL document
<URL:ftp://ds.internic.net/internet-drafts/draft-ietf-uri-relative-url-06.txt>
is up for 'last call' before becoming a proposed standard RFC. Check
it out.

Next message: Arthur van Hoff: "Re: your mail"
Previous message: [email protected]: "URLs in saved documents"
Maybe in reply to: Paul Phillips: "URI security"