Hacker DirectoryHacker Directory

WEB / WEB-06.03

URL resolution

Follow how one relative reference yields different URLs under different bases; separate parsing success from resource loading.

CORE · RED · BLUE · ARTIFACT · PRACTICE

1. Core · Mechanism

Read every scenario without motion

Current directory

  1. Reference selected

    A link reference exists; there is no absolute result yet.

    Reference
    notes
    Local resolver
    Base: pending
    Application result
    Destination: absent
  2. Base context ready

    This operation uses a declared base string and creates no Document.

    Reference
    notes
    Local resolver
    https://books.example/catalog/lesson.html?lang=tr#old
    Application result
    Destination: absent
  3. Resolution is applied

    The base current directory is /catalog/, so notes replaces the final segment and produces /catalog/notes. This path reference carries neither the old query nor fragment.

    Reference
    notes
    Local resolver
    https://books.example/catalog/notes
    Application result
    Destination: pending consumption
  4. Final URL is a separate result

    The application receives the normalized candidate; no network has started.

    Reference
    notes
    Local resolver
    Parse: success
    Application result
    https://books.example/catalog/notes
  5. The operation boundary remains visible

    Address resolution is not resource loading or permission.

    Reference
    notes
    Local resolver
    Local calculation complete
    Application result
    Fetch: not started

Trailing slash

  1. Reference selected

    A link reference exists; there is no absolute result yet.

    Reference
    notes
    Local resolver
    Base: pending
    Application result
    Destination: absent
  2. Base context ready

    This operation uses a declared base string and creates no Document.

    Reference
    notes
    Local resolver
    https://books.example/catalog/lesson/
    Application result
    Destination: absent
  3. Resolution is applied

    The base has a trailing slash, giving current directory /catalog/lesson/. notes resolves within it as /catalog/lesson/notes; no filesystem check occurs.

    Reference
    notes
    Local resolver
    https://books.example/catalog/lesson/notes
    Application result
    Destination: pending consumption
  4. Final URL is a separate result

    The application receives the normalized candidate; no network has started.

    Reference
    notes
    Local resolver
    Parse: success
    Application result
    https://books.example/catalog/lesson/notes
  5. The operation boundary remains visible

    Address resolution is not resource loading or permission.

    Reference
    notes
    Local resolver
    Local calculation complete
    Application result
    Fetch: not started

Query-only

  1. Reference selected

    A link reference exists; there is no absolute result yet.

    Reference
    ?lang=en
    Local resolver
    Base: pending
    Application result
    Destination: absent
  2. Base context ready

    This operation uses a declared base string and creates no Document.

    Reference
    ?lang=en
    Local resolver
    https://books.example/catalog/lesson.html?lang=tr#old
    Application result
    Destination: absent
  3. Resolution is applied

    ?lang=en retains the base scheme, authority and path, replaces the query and removes the old #old fragment. The result is /catalog/lesson.html?lang=en.

    Reference
    ?lang=en
    Local resolver
    https://books.example/catalog/lesson.html?lang=en
    Application result
    Destination: pending consumption
  4. Final URL is a separate result

    The application receives the normalized candidate; no network has started.

    Reference
    ?lang=en
    Local resolver
    Parse: success
    Application result
    https://books.example/catalog/lesson.html?lang=en
  5. The operation boundary remains visible

    Address resolution is not resource loading or permission.

    Reference
    ?lang=en
    Local resolver
    Local calculation complete
    Application result
    Fetch: not started

Invalid base

  1. Reference ready

    The notes reference requires an absolute context.

    Reference
    notes
    Local resolver
    Base: pending
    Application result
    Destination: absent
  2. Base is invalid

    not an absolute base is not a valid base for this constructor.

    Reference
    notes
    Local resolver
    Base: invalid
    Application result
    Destination: absent
  3. TypeError occurs

    Failure occurs during parsing; DNS/TLS/HTTP has not started.

    Reference
    notes
    Local resolver
    TypeError
    Application result
    Destination: absent
  4. The failure result is retained

    A previous successful URL is not substituted as this operation’s result.

    Reference
    notes
    Local resolver
    Parse: failure
    Application result
    Destination: null; fetch: false

ACTORS · STATE · DATA FLOW

Resolution needs a reference and context

The notes link on Duru’s catalogue page is not an absolute address by itself. Its result depends on processing the reference with a base. Given https://books.example/catalog/lesson.html?lang=tr#old, notes resolves to https://books.example/catalog/notes.

URL resolution differs from DNS resolution. It locally produces an absolute URL; it has not obtained an IP, connected to a server, or read a notes record. A resolved-address observation is distinct from a loaded-resource observation.

Three scene actors show the reference, chosen base, and result. They are roles in a local decision rather than network services, so the steps generate no wire packets.

The final slash changes the current directory

Bases ending in /catalog/lesson.html and /catalog/lesson/ provide different current directories. The former ends its current directory at /catalog/, yielding /catalog/notes. The trailing slash in the latter yields /catalog/lesson/notes.

The parser does not know whether lesson.html is a file. Hierarchical path structure and the trailing slash, not a filename extension, determine the calculation. notes and ./notes use the current directory in these examples.

Concatenating strings can preserve an irrelevant query/fragment or treat the final segment as a directory. The artifact compares both bases using the same reference and records the native constructor’s result.

Follow root and parent references

/notes is root-relative: it retains the base origin context but ignores the base directory. Either catalogue base produces https://books.example/notes. This root is not a server filesystem root.

../notes selects the parent of the current directory. A /catalog/lesson.html base has current directory /catalog/, yielding /notes; /catalog/lesson/ has a deeper current directory and yields /catalog/notes.

These ordinary dot-segment calculations belong to URL path processing and execute no filesystem access. The artifact computes benign catalogue links; selecting an application route remains a separate responsibility.

Query-only and fragment-only references differ

?lang=en selects a new query while retaining the base scheme, authority, and path. Because the new reference carries no fragment, #old is not retained. The result is https://books.example/catalog/lesson.html?lang=en.

#new retains the path and existing query while replacing the fragment: https://books.example/catalog/lesson.html?lang=tr#new. Combine this with the earlier fragment/request-target distinction; resolution itself sends no request.

An absolute https://library.example.org/notes reference selects a destination independent of a valid base’s host/path context. Syntax validity does not establish suitability under the application’s destination policy. The page containing a link does not alone describe its final destination.

Document bases and the failure boundary

An HTML Document’s base commonly comes from its document context; the first base element with href can instead provide the standard’s frozen base URL. document.baseURI is not guaranteed to match the address bar text in every context. about:blank and srcdoc also have fallback rules.

This fixture creates no Document: it passes a declared HTTPS base string to new URL(reference, base). It does not test HTML base inheritance or navigation. The specification defines browser context behavior; the artifact observes the local API.

An invalid base makes the constructor throw TypeError. A failed operation must not display a previous successful destination as its new result: retain no-candidate and fetch-not-started states. Retrying with a valid base starts another calculation rather than rewriting the failure.

2. Red · Trust & Impact

Read every scenario without motion

Base context

  1. The reference was selected with its base

    notes resolves to /catalog/notes with the lesson.html base, but /catalog/lesson/notes with the /catalog/lesson/ base. One reference differs under different effective bases.

    Reference/base evidence
    notes / trailing-slash base
    URL construction gate
    No candidate
    Network/access conclusion
    No network outcome
  2. The parser-gate outcome was produced

    trailing-slash expects https://books.example/catalog/lesson/notes. The parser result does not show which server resources exist.

    Reference/base evidence
    notes / trailing-slash base
    URL construction gate
    https://books.example/catalog/lesson/notes
    Network/access conclusion
    No network outcome
  3. The false-network conclusion was stopped

    A candidate proves no request sending, response receipt or exposure. Application destination policy separately evaluates the resolved structured URL.

    Reference/base evidence
    notes / trailing-slash base
    URL construction gate
    https://books.example/catalog/lesson/notes
    Network/access conclusion
    Candidate only / delivery unknown
  4. Query and fragment effects were separated

    ?lang=en changes the query and removes the old fragment; #new preserves query lang=tr. Final-URL component differences do not measure server locale behavior.

    Reference/base evidence
    Query changes / fragment retains query
    URL construction gate
    https://books.example/catalog/lesson/notes
    Network/access conclusion
    Candidate only / delivery unknown
  5. Root and parent depend on context

    /notes resolves at the origin root; ../notes reaches root from lesson.html but /catalog/notes from a trailing directory base. These are local URL-resolution rules, not filesystem access.

    Reference/base evidence
    Query changes / fragment retains query
    URL construction gate
    Root / parent require selected base
    Network/access conclusion
    Candidate only / delivery unknown
  6. The closed-gate or candidate scope was preserved

    The resolved href agrees with its selected base context. Link calculation establishes neither same-origin policy nor resource authorization.

    Reference/base evidence
    Query changes / fragment retains query
    URL construction gate
    Root / parent require selected base
    Network/access conclusion
    Resolved candidate / access unknown

Invalid base

  1. The reference was selected with its base

    Relative notes is paired with not an absolute base. A reference alone produces no destination; the caller’s selected context must be valid.

    Reference/base evidence
    notes / invalid base
    URL construction gate
    No candidate
    Network/access conclusion
    No network outcome
  2. The parser-gate outcome was produced

    URL construction with an invalid base produces TypeError. Destination stays null and fetch never starts. A previous successful case’s href is not carried into the failure branch as a candidate.

    Reference/base evidence
    notes / invalid base
    URL construction gate
    TypeError / candidate=null
    Network/access conclusion
    No network outcome
  3. The false-network conclusion was stopped

    TypeError indicates a local URL-construction failure, not HTTP 404 or a transport timeout. Because no destination is produced, this case does not establish that the browser sent a request.

    Reference/base evidence
    notes / invalid base
    URL construction gate
    TypeError / candidate=null
    Network/access conclusion
    No candidate / no fetch
  4. The error belongs to one input pair

    Reference notes and base not an absolute base remain in one operation record. Importing another case’s valid base would change the failed construction’s inputs rather than explain its error.

    Reference/base evidence
    notes / invalid-base record
    URL construction gate
    TypeError / candidate=null
    Network/access conclusion
    No candidate / no fetch
  5. Candidate absence was preserved

    Parser failure remains TypeError with candidate=null. The construction error is returned to the caller instead of reusing a prior successful href; this branch creates no destination or request.

    Reference/base evidence
    notes / invalid-base record
    URL construction gate
    TypeError / candidate=null
    Network/access conclusion
    No candidate / no fetch
  6. The closed-gate or candidate scope was preserved

    Invalid base stops at the local gate with no stale href. The error is not moved to networking or server policy; the needed evidence is reference/base/parser error.

    Reference/base evidence
    notes / invalid-base record
    URL construction gate
    TypeError / candidate=null
    Network/access conclusion
    Local TypeError / fetch not started

ASSUMPTION · BOUNDARY · CONTROL

Identify the context that produced the final URL

Reporting a reference alone omits context: notes can produce different paths under different bases. Record the reference, declared/effective base, and normalized final URL together.

Compare the trailing-slash branch. A different result does not imply inconsistent parsing; its context changed. Without actual fetch or server evidence, address calculations do not establish resource exposure.

Compare query-only and fragment-only cases: ?lang=en changes the query and drops the old fragment, while #new retains lang=tr. Naming the component changed is stronger mechanism evidence than saying the link changed. Server locale behavior has not been measured here.

Do not label local failure as network failure

TypeError from an invalid base is neither a transport timeout nor HTTP404. Identify the incomplete stage: without a parsed result there is no destination for request construction.

Origin/site comparisons or application destination checks use the resolved structured URL. A reference alone does not measure that boundary, and URL resolution is not authorization.

The failed branch keeps destination null. Carrying a previous successful case’s href into it would invent a result for an operation that produced none. In a review, error type, selected base, and candidate presence must belong to the same operation record rather than being assembled from different cases.

3. Blue · Secure development & defense

Read every scenario without motion

Base change

  1. The operation record has two inputs

    Each comparison retains reference and base. current-directory notes with base=https://books.example/catalog/lesson.html?lang=tr#old gives /catalog/notes.

    Resolution input evidence
    Reference + base same operation
    URL comparison
    No URL calculation
    Observation boundary
    No evidence scope
  2. Trailing-slash output was compared

    With base https://books.example/catalog/lesson/, the same notes gives /catalog/lesson/notes. The difference is changed base context, not parser inconsistency or a need for manual concatenation.

    Resolution input evidence
    Reference + base same operation
    URL comparison
    lesson.html → /catalog/notes; lesson/ → /catalog/lesson/notes
    Observation boundary
    No evidence scope
  3. Root and parent are compared under the same base

    /notes resolves at the origin root. ../notes produces /notes with the lesson.html base and /catalog/notes with the lesson/ base. These are separate rows; retaining reference and base together identifies the directory rule behind each result.

    Resolution input evidence
    Reference /notes or ../notes; base retained
    URL comparison
    Root /notes; parent depends on base
    Observation boundary
    Local URL result; no filesystem access
  4. An absolute reference can select another authority

    Absolute reference=https://library.example.org/notes replaces the base with its own URL. Parser output can show an origin change but does not measure application allowance of that destination.

    Resolution input evidence
    Separate absolute-reference comparison
    URL comparison
    https://library.example.org/notes
    Observation boundary
    No evidence scope
  5. The producer and inputs match the record

    The href output is produced by the local URL API. Bind reference, base and expected result to the same operation; do not copy a successful href from another base. Document-base inheritance or navigation evidence requires an actual Document.

    Resolution input evidence
    Reference + base + output retained
    URL comparison
    Producer: local URL API
    Observation boundary
    Coverage: declared-string resolution
  6. The changed base explains the result

    The differing paths for notes under two bases result from changed context. A URL-resolution record is neither DNS, HTTP receipt nor resource authorization evidence. Each of those questions requires its own producer.

    Resolution input evidence
    notes / two separate base contexts
    URL comparison
    lesson.html → /catalog/notes; lesson/ → /catalog/lesson/notes
    Observation boundary
    Resolution known; network unknown

Query / fragment

  1. Two references were paired with the same base

    The supplied base is https://books.example/catalog/lesson.html?lang=tr#old. ?lang=en and #new are separate inputs, compared while the base remains unchanged. No request is made beyond the URL calculation.

    Resolution input evidence
    Same base; ?lang=en / #new
    URL comparison
    Component results pending
    Observation boundary
    No network observation
  2. Query-only retains the path

    ?lang=en retains scheme/authority and path /catalog/lesson.html. The new query is lang=en and the old #old is removed. This row gives expectedHref=https://books.example/catalog/lesson.html?lang=en.

    Resolution input evidence
    Reference ?lang=en
    URL comparison
    Same path; query en; no hash
    Observation boundary
    No server-locale outcome
  3. Fragment-only retains the existing query

    The separate #new row retains the same base path and query lang=tr, replacing the fragment with new. It yields https://books.example/catalog/lesson.html?lang=tr#new. The query-only row’s lang=en is not carried over.

    Resolution input evidence
    Reference #new; same base
    URL comparison
    Same path; query tr; hash #new
    Observation boundary
    DOM navigation unmeasured
  4. The request target and fragment differ

    For the latter final URL, the ordinary HTTP path/query candidate is /catalog/lesson.html?lang=tr. #new remains a separate client component. Derivation neither sends a request nor shows that the fragment caused UI scrolling.

    Resolution input evidence
    Path/query candidate; #new separate
    URL comparison
    Query tr retained; fragment absent from target
    Observation boundary
    HTTP and scrolling unobserved
  5. The parser produces the component evidence

    Href, search and hash outputs come from the local URL API. Actual Document/baseURI, browser fragment handling and server locale behavior have different producers. A supplied base string does not establish execution of those contexts.

    Resolution input evidence
    Both references and the same base retained
    URL comparison
    Producer: URL API; no Document created
    Observation boundary
    Coverage: component resolution
  6. Results are not filled from another row

    Query-only and fragment-only results remain tied to their own inputs. The invalid-base comparison instead gives TypeError, destination=null and fetchStarted=false. No successful href fills the failed row’s destination.

    Resolution input evidence
    Query en/no hash; query tr/#new
    URL comparison
    Successful href and TypeError are separate rows
    Observation boundary
    Component results supplied; no network outcome

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Treat the base as explicit context data

Make the base source explicit in code using relative references: configuration, Document context, or caller input. Exercise a fixture set with trailing/non-trailing slash bases and root/query/fragment forms.

Use a standard API such as new URL instead of duplicating parsing through concatenation. Apply the application’s destination requirements to the normalized result and do not continue using an old result after parsing fails.

In the URL lab, predict notes under both bases before comparing command output. If the results differ, reread the base context without changing the reference. This separates changed inputs when diagnosing a bug; it can be a local calculation issue requiring neither a network retry nor a server change.

Attach evidence to the correct stage

A resolution record is produced by the URL parser: compare href or error type for the same reference and base. Establishing a Document base requires actual Document context; establishing resource loading requires fetch/response observations. A local parser result is not evidence of those other stages.

A benign regression table records reference, base, expected href, and error type. Use a separate case when the base changes, and verify that failure leaves no candidate in the model. Keep the calculation visible in readable steps when motion is disabled.

For example, notes gives /catalog/notes with lesson.html but /catalog/lesson/notes with lesson/. Attach query-only and fragment-only results to the same base and identify the changed component. An invalid base retains TypeError alongside destination=null. A successful address calculation establishes neither resource existence nor user access.

NOW APPLY IT TO THE CASE

How are local candidates, parser errors and network outcomes kept separate?

Reference notes chooses different paths with lesson.html and lesson/ bases. An invalid base yields TypeError and a null destination. That local parsing result is neither HTTP 404 nor a network timeout.

Identify the case’s browser and API through URL components. Target, origin and site answer different questions; identify which decision uses each one.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Relative-reference / base / result ledger

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations
{
  "cases": [
    {
      "case": "current-directory",
      "reference": "notes",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://books.example/catalog/notes"
    },
    {
      "case": "dot-current",
      "reference": "./notes",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://books.example/catalog/notes"
    },
    {
      "case": "trailing-slash",
      "reference": "notes",
      "base": "https://books.example/catalog/lesson/",
      "expectedHref": "https://books.example/catalog/lesson/notes"
    },
    {
      "case": "root",
      "reference": "/notes",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://books.example/notes"
    },
    {
      "case": "parent",
      "reference": "../notes",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://books.example/notes"
    },
    {
      "case": "parent-directory",
      "reference": "../notes",
      "base": "https://books.example/catalog/lesson/",
      "expectedHref": "https://books.example/catalog/notes"
    },
    {
      "case": "query",
      "reference": "?lang=en",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://books.example/catalog/lesson.html?lang=en"
    },
    {
      "case": "fragment",
      "reference": "#new",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://books.example/catalog/lesson.html?lang=tr#new"
    },
    {
      "case": "absolute",
      "reference": "https://library.example.org/notes",
      "base": "https://books.example/catalog/lesson.html?lang=tr#old",
      "expectedHref": "https://library.example.org/notes"
    }
  ],
  "invalidBase": {
    "reference": "notes",
    "base": "not an absolute base",
    "expectedError": "TypeError",
    "destination": null,
    "fetchStarted": false
  },
  "documentBaseModel": "Declared strings only; no Document/base element created",
  "networkRequestsExecuted": 0
}
cases.reference
Ordinary link reference to resolve.
cases.base
Declared absolute context for this operation.
cases.expectedHref
Serialization to check against the native URL constructor.
invalidBase.destination
Null after failure; no fallback to a previous success.

Synthetic ordinary links resolved with native Node URL. No Document base inheritance, browser navigation, DNS, or fetch executes.

Two reality checks

Relative resolution concatenates the base and reference.

Path, trailing slash, query, and fragment rules transform components separately. Use a standard parser.

A resolved URL proves successful DNS and resource loading.

Resolution is local calculation; DNS, TLS, HTTP, and application outcomes require separate evidence.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

Does the reference notes yield the same URL with bases /catalog/lesson.html and /catalog/lesson/?

  1. No; the results are /catalog/notes and /catalog/lesson/notes.
  2. Yes; appending notes to the string is sufficient.
Read the explained answer

No; the results are /catalog/notes and /catalog/lesson/notes. — The final segment of the file-like base is replaced; the trailing-slash base resolves within its directory.

Which different components are preserved by query-only and fragment-only references?

Selected lesson artifact fields; teaching example

cases[6]
{"case":"query","reference":"?lang=en","base":"https://books.example/catalog/lesson.html?lang=tr#old","expectedHref":"https://books.example/catalog/lesson.html?lang=en"}
cases[7]
{"case":"fragment","reference":"#new","base":"https://books.example/catalog/lesson.html?lang=tr#old","expectedHref":"https://books.example/catalog/lesson.html?lang=tr#new"}
  1. Both reset the path to the root.
  2. ?lang=en preserves the path, replaces the query and removes the old hash; #new preserves the query.
Read the explained answer

?lang=en preserves the path, replaces the query and removes the old hash; #new preserves the query. — ExpectedHref explicitly shows different inherited components in the two resolutions.

Why is TypeError from an invalid base not an observed network-request failure? Also distinguish Document base context.

Read the explained answer

An invalid absolute base produces no destination; selected fetchStarted=false. This local URL API error is not a remote server response. The fixture uses explicit base strings and creates no actual Document/base element. NetworkRequestsExecuted=0 prevents reachability claims from parsing outcomes.

□ I separated local URL error from network failure.

□ I distinguished explicit base strings from Document context.

Open the application console · request / response / browser
Also open request, URL, cookie and DOM examples

MANUAL LAB

URL Boundary Lab

Predict components, origin/site comparisons, and relative resolution before comparing native API output.

Open the prediction → observation → explanation workbook ↗Source on GitHub ↗

Sources and scope