URL anatomy and resource addressing

Separate the resource from its address

Duru opens Atlas in a book catalogue. The resource is the application’s conceptual entity; the URL is an identifier addressing it. The server can offer an HTML or JSON representation of that entity. Reading an address does not establish the returned bytes, existence, or Duru’s permission.

RFC 3986 presents URI as the general identification framework and URL as a category associated with location or an access mechanism. The modern browser API is named URL; WHATWG specifies interoperable browser parsing. Generic RFC syntax and browser parsing are not identical algorithms for every edge case.

Parsing is local text processing, distinct from DNS, transport, TLS, or sending an HTTP request. books.example is an educational name and is never contacted by this scene.

Read a URL by its components

Read https://books.example:8443/catalog/atlas?lang=tr&tag=network&tag=web#summary as scheme, authority with host/port, path, query, and fragment. Component delimiters matter; splitting everything on slashes is insufficient.

The artifact records protocol, hostname, host, port, pathname, search, and hash from new URL(input). protocol includes its colon, search begins with ?, and hash begins with #. Distinguish the URL record concept from the getter’s serialized representation.

hostname is books.example; host includes :8443. The path is /catalog/atlas, the query contains three pairs, and the fragment identifies summary. These are parser observations, not an HTTP request or server routing decision.

What does the scheme select?

The scheme selects how an address is interpreted. http and https address web resources; other schemes such as mailto do not promise the same transport or path structure. A valid URL does not universally imply an HTTP GET.

An https string expresses intended HTTPS use. Successful parsing has not validated a certificate or established a secure connection; TLS has its own handshake and validation boundaries.

An application accepting only HTTPS resource links applies its scheme policy to the parsed result. Syntax validity and suitability for an application are separate decisions, neither of which proves network success.

Host and port are separate from the path

The authority’s host identifies a target and can use a domain name or an IP address form. DNS resolves domain names; a parser producing hostname has not obtained a DNS answer or proved that a server exists.

The numeric port contributes to selecting a service endpoint. This fixture explicitly chooses 8443; that number is not a universal secure alternative to HTTPS. A listener and its protocol behavior require separate evidence.

HTTPS has default port 443. Parsing https://books.example:443/catalog removes the default port from serialization, and the port getter returns an empty string. The service has not become portless. Non-default 8443 remains and changes origin comparisons.

host can include a port while hostname does not. For logs and configuration, use the components produced by a consistent parser rather than searching the raw string for familiar text.

A path is an application address

/catalog/atlas is the hierarchical path following the authority. Its segments may be inputs to an application’s route contract. They need not correspond to a catalogue directory and an atlas file on the server: a handler can produce a database-backed response.

The server or framework gives the path its application meaning; the URL parser does not know the route table. Case or a trailing slash can select a different resource, a redirect, or the same route according to that contract. No filesystem result is implied here.

The query is not part of pathname. For /catalog/atlas?lang=tr, routing, locale selection, and cache-key construction are subsequent operations with explicit rules.

Read query pairs without losing multiplicity

The query starts with ?. Its business meaning is application-defined. Key/value pairs separated by & are a common form representation handled by URLSearchParams; allowed keys and values still need application rules.

This example repeats tag. get("tag") returns the first value, network, while getAll("tag") preserves network and web. Code assuming a single value can silently lose the second label. Multiplicity belongs to the schema contract rather than being resolved by syntax alone.

Do not hand the entire URL string to URLSearchParams as if it were a query. Use a URL object’s searchParams or the separated search text. lang=tr is a locale candidate, not evidence of object ownership or identity.

Where does the fragment stay?

#summary is a fragment. It is excluded from the target of a normal HTTP resource request and can guide the client to a part of the representation. The derived origin-form path/query is /catalog/atlas?lang=tr&tag=network&tag=web, without #summary.

Client-side handling does not make a fragment a secret vault. Page code can read it and send it in a separate request. The narrower claim is that the initial URL’s fragment component is not included in its ordinary resource request.

The scene prepares a path/query candidate while keeping the fragment separate. It does not send HTTP or execute scrolling; derivation and fragment consumption remain distinct local operations.

Encoding represents data for transport

Percent-encoding represents a byte using % and two hexadecimal digits. Converting Unicode text to bytes first requires an encoding. URLSearchParams uses UTF-8 and form serialization: the fixture’s q value notlar ı becomes q=notlar+%C4%B1.

In form query serialization a space becomes +; a literal plus is preserved as %2B. A plus does not universally mean a space in every URL component. URL.search and URLSearchParams can serialize the same values differently, so identify the layer being observed.

Encoding is not encryption or authorization: the decoded value remains application input. Treating already encoded text as a raw value changes its representation on another encoding pass. Keep parsing and validation order explicit.

The artifact contains small normal-text native API round trips, with no custom server decoding pipeline or parser-bypass model.

Absolute addresses and relative references

An absolute URL supplies its own scheme and required parsing context. A relative reference such as /catalog/atlas cannot identify its host without a base. new URL("/catalog/atlas") throws TypeError; a valid HTTPS base makes resolution possible.

Resolution is not string concatenation. The base path’s last slash, root-relative versus directory-relative form, and query/fragment references affect the result. WEB-06.03 follows those calculations separately.

After parsing, inspect the resulting absolute URL’s components again. Reachability and suitability for the application remain separate from resolution, naming, and permission.

Identify the operation that establishes trust

Start a security review by identifying the consumer: browser parser, server router, or application validation. An address can serve different purposes. Familiar-looking text is not a substitute for parsed components or a policy decision.

Follow Duru’s ordinary catalogue link through the artifact. Local scheme, hostname, and port candidates exist before resource authorization. Ask which structured value the next layer trusts and for what purpose.

Place the artifact’s tags array, first get result, and candidate request target side by side. network and web are separate query values; summary is not one of them. Explain why the second tag survives and where the fragment remains on the client.

Representation loss can lose a decision input

Keeping one of two tags or mistaking a fragment for the request target produces a misleading interpretation. Record the reference, parsed components, and schema result as separate observations.

The two tag query pairs and #summary fragment belong to different consumers. The URL parser separates their fields; the application schema decides which query values to use. Excluding the fragment from the request target is not a confidentiality control that prevents client code from sending it in a separate message.

Compare raw A+B with serialized q=A%2BB in the encoding branch. They are two representations of an ordinary value, not a new permission or an encrypted secret. A successful round trip verifies the selected API transformation, not an entire server input pipeline.

Use a consistent parser and explicit application policy

Use a standard parser, then evaluate application requirements such as allowed schemes, destinations, or ports against its structured output. Parsing success is not an allow decision, and query schema validation remains separate.

Keep raw input, normalized address, and policy results distinguishable in configuration and observations. Record parser acceptance and application acceptance separately; add network success only when measured.

Preserve data boundaries when logging and creating links

Avoid unnecessary secrets or personal data in queries: addresses can appear in logs, history, and telemetry. This fixture contains only public catalogue labels. Select necessary logging fields rather than treating every full URL as a persistent identity record.

Build links with URL and URLSearchParams, then verify the expected pathname, parameter multiplicity, and fragment separation using benign fixtures. Encoding should not be labeled a security control.

Keep the default-port case separate in lab observations. If a colleague mistakes the empty port getter for an absent service port, show the normalized href with its scheme. Fixing the representation used for logs or configuration helps interpret two text forms of the same destination correctly.