URLs or URis, What’s the difference?

by Vid Luther on December 4, 2009

in php, security, web

A lot of people confuse the terms URLs and URIs. This morning, the PHP Advent post by David Sklar exemplified that. Paul Reinheimer already has a rebuttal for this, and I’m expecting many more.

I agree with Paul, David seems to be missing the point.

  • URI: Uniform Resource Identifier/Indicator
  • URL: Uniform Resource Locator

The keyword here is IDENTIFIER. Just because you know the identifier, doesn’t mean you know the content/topic yet. An Identifier is normally used by machines to find out where to go. URL Shortening services produce URIs by default, but offer the ability to create URLs. Take for example: http://tinyurl.com/yj432kb and http://tinyurl.com/thirdpartycode . The first one is a URI, a human has no clue what it’s about. The second one, you can guess what it’s about.

The fact that they both end up at the same location may make you think that human readable urls aren’t important, but as the number of shortened urls grow, and the number of services providing these urls grow, we’ll need some way of knowing what’s NSFW, what’s taking you to a phishing site, or what’s just a prank site. As this happens, the chances of someone clicking on jy32kb vs clicking on /thirdpartycode decreases, because people will get burnt too often.

I’m already seeing security teams blocking emails containing tinyurls, twitter clients have the ability to display the end url in your view. URLs do matter, even if they point to the same site, www.cnn.com looks a lot more trustworthy than http://tinyurl.com/4qz

Sure, I can manipulate URLs to give a false sense of security, or to try and fool the search engines. But that’s a different topic, and is already being addressed by search engines

  • I'm sorry, but this just isn't correct. A URI is the superset of URL and URN. A URN defining a resources identity and a URL defines it's location. I think the Wikipedia example describes it best; a URN is like a person's name while a URL is like their street address. The address of this page is a URN because it uniquely identifies this blog post, it is a URL because it allows a browser to locate it and it is a URI because it is one of those things.
    http://en.wikipedia.org/wiki/Uniform_Resource_I...
    http://en.wikipedia.org/wiki/Uniform_Resource_Name
    http://en.wikipedia.org/wiki/Url
  • Roger Wilco
    Your distinction between URI and URL is very arbitrary. There is a specific definition of what's a URI and what's a URL. It's written down in RFC 3986 (http://www.ietf.org/rfc/rfc3986.txt).

    For example, urn:oasis:names:specification:docbook:dtd:xml:4.1.2 is a URI (and more specifically a URN) but not a URL. It's understandable by humans none the less. On the other hand, both of your examples http://tinyurl.com/yj432kb and http://tinyurl.com/thirdpartycode are URIs and more specifically URLs.
  • David A.
    The funniest thing that David is forgetting is that there are actually a HUGE number of competent programmers/designers/project managers/savvy business owners who would take advantage of it. His opening about "J. Random Programmer" exemplifies that and I think if it's not much more work then we should try to include that audience. It's the same reason why some people still support IE6.
  • Ed
    I tend to agree. I suspect it does matter more than David says, but I do think it is less important to Average Joe than URL beauty queens like me want to believe.
blog comments powered by Disqus

Previous post:

Next post: