Web · foundation
URL anatomy
A URL is a serialized identifier whose components can include a scheme, authority with host and optional port, path, query, and fragment. The scheme determines how the remaining components are interpreted and used.
Why it matters
Correctly separating URL components prevents bugs in routing, encoding, caching, authentication, and command-line requests. It also clarifies which pieces are sent to an HTTP server.
Mental model
How to reason about url anatomy
Parse the URL structurally before interpreting its characters: the scheme selects a protocol handler, the authority locates an endpoint, and the fragment is handled by the client rather than transmitted. For an ordinary direct HTTP request in origin-form, the path and query become the request target; proxies, CONNECT, and OPTIONS can use other HTTP request-target forms.
Analogy
A URL is a structured shipping instruction: service type, destination, route within the destination, optional parameters, and a private note for the recipient's local handling.
Examples
See the boundary, not just the happy path
Worked example · Separate the components
https://api.example.com:8443/v1/users?active=true#resultshttps is the scheme, api.example.com the host, 8443 the explicit port, /v1/users the path, active=true the query, and results the fragment. The fragment is not part of the HTTP request target sent to the server.
Worked example · Encode data as a query value
curl --get --data-urlencode 'q=a/b & c' https://example.com/searchcurl percent-encodes characters that would otherwise have structural meaning in the query. Encoding a component is safer than concatenating untrusted text into a URL.
Useful contrast · A domain name is only one component
example.comThis can be a host name, but by itself it lacks a URL scheme and path context. A parser may not treat it as an absolute URL without additional rules.
Common mistakes
Misconceptions to remove early
Sending the fragment to the server
For HTTP URLs, clients remove the #fragment before constructing the request. Server routing and logs therefore cannot rely on receiving it.
Encoding the whole URL as one undifferentiated string
Percent-encoding rules apply by component. Encoding separators such as : or / can change structure, while failing to encode data characters can inject unintended query or path syntax.
Quick check
Can you predict the result?
1. Which component of https://x.test/a?q=1#part is not sent in the HTTP request?
- • The fragment part after #
- • The path /a
- • The query q=1
2. Why should user input be encoded as a URL component instead of concatenated directly?
Keep building