URL Parser

A URL decomposes into scheme, optional credentials, host, optional port, path, query and fragment, and each part has its own escaping rules. The single most common encoding bug follows from ignoring that: encoding an entire URL rather than one component escapes the separators that give it structure, turning a working address into one opaque string. Encode the component, then assemble: never the reverse.

The fragment, everything after the hash, is the part that never reaches the server. It is stripped by the browser before the request is sent, which is why single-page applications historically used it for routing and why putting anything sensitive there is both safer and less useful than it looks: server logs will not have it, but browser history and any JavaScript on the page will. Query parameters, by contrast, travel in the request line and appear in access logs, proxy logs and referrer headers, which is why access tokens do not belong in them.

Two structural details cause disproportionate trouble. Query strings have no specification for repeated keys, so whether ?a=1&a=2 yields the first value, the last, or an array depends entirely on the framework parsing it, and two services in the same system can disagree. And a plus sign means a space in form-encoded data but is a literal plus in a path segment, so the same character decodes differently depending on where it sits. Parsing a URL into its parts, rather than reading it as a string, is what makes both of these visible before they become bugs.