Live data from Hacker News

I’ve banned query strings

chrismorgan.info

211–220 of 317 posts

Re: I’ve banned query strings

#211
post #195
post #179

I love the hilarious output. He even coded in a special case for just a question mark without any params: https://chrismorgan.info/no-query-strings ? Never have I seen such a sassy web server

great spot! I noticed that his server also doesn't accept URLs ending is a single `/`: https://chrismorgan.info/no-query-strings/ But instead of the banned query strings message, it just returns a very sassy not-a-404 page. Once again, this is violating a common convention, but there's nothing in the HTTP spec that requires treating these URLs the same. Similarly the site also 404s when you add extra slashes like htt…

You’re misreading a couple of things. There’s no violation of common convention where you’re pointing.

Where dealing with static file servers:

For URLs that are supposed to include a trailing slash and the server will find that directory and serve its index.html: it’s customary, though not ubiquitous, to redirect from no-slash to slash. (Some, including popular commercial services, serve the index.html file instead of redirecting to add the slash. This is extremely wrong because it changes the meaning of relative URLs.)

But the other way round is not common.

My URLs don’t include a file extension, and I think that’s influencing your perception into thinking no-query-strings is logically a directory name. But it’s not, it’s logically a file name, just with the .html removed as unnecessary.

Take https://susam.net/no-query-strings.html as an example; Susam is more clearly just serving from a file system than I am, and leaves the “.html” file extension in the URL. Do you expect https://susam.net/no-query-strings.html/ to work? I hope not. It’s a 404, just as I’d expect, because there is no directory with that name.

> not-a-404 page

No, that’s a 404, just a plain old boring 404, same as any other. In fact, it’s the same 404 page I’ve been using since 2019, just with dark mode support added.

> extra slashes

Ah, now for that I had to go out of my way, because Caddy misbehaves out of the box: https://chrismorgan.info/Caddyfile#:~:text=%40has%5Fmultiple...

> digression: I love trying "domain.com//" on various sites.

Closely related is adding the trailing dot of a fully-qualified domain name: https://example.com./. I didn’t remember to try this on my new site, but it turns out Caddy won’t talk at https://chrismorgan.info./, so that’s probably good.

Re: I’ve banned query strings

#213

While I don't take the author's hard stance, I do hate gratuitous query params that result in links that are thousands of characters long. I use this bookmarklet to strip query params before sharing a link: javascript:(()=>navigator.clipboard.writeText(location.origin+location.pathname))();

This corrupts a URL like:

  https://example.com/?p=20&utm_source=spam
to:

  https://example.com/
when in fact we want the following:

  https://example.com/?p=20
A possible improvement can be:

  javascript:(()=>{const u=new URL(location.href);[...u.searchParams.keys()].forEach(k=>{if(k.startsWith('utm_')){u.searchParams.delete(k)}});navigator.clipboard.writeText(u.href)})();

Re: I’ve banned query strings

#215

This basically boils down to "reject any incoming links from facebook, pinterest, chatgpt, linkedin, twitter, reddit, youtube, etc". I guess sure? There's a once-famous guy who shows goatse to all referring links from HN. I guess if you get enough traffic that you can pick which sources you want to allow, that's a good problem to have.

How much do platforms mangle people’s links? Figured I’d check the ones you mention. (I was actually mildly surprised to be able to find examples in all of them without needing to log in once. I thought LinkedIn and ChatGPT wouldn’t.)

Facebook: no.

Pinterest: ?utm_source=Pinterest&utm_medium=organic.

ChatGPT: ?utm_source=chatgpt.com. (Aside: wow it’s confidently and atrociously wrong if you ask it about me. Ask it just vaguely enough, and it hallucinates someone clearly inspired by me, but who has done a whole lot of stuff that I haven’t. Ask it more precisely about me, and it gets all kinds of details wrong still. I feel further vindicated in hating this stuff. You made me use ChatGPT for the very first time.)

LinkedIn: no.

Twitter: no.

Reddit: no.

YouTube: no.

> if you get enough traffic that you can pick which sources you want to allow, that's a good problem to have.

Nah, I just don’t care about them. It’s my place, I’m doing things on my own terms. Should I discover it to be causing me problems, I’ll burn that bridge when I come to it.

Re: I’ve banned query strings

#217
post #93

Earlier quoted context omitted.

"You could argue that I’m abusing 414 URI Too Long. I respond that it’s funnier this way. Other options I considered were: 400 Bad Request, the generic client error code, which is correct but boring; 402 Payment Required, and honestly if you want to pay me to make a particular URL with query string work, I’m open to it; 404 Not Found, but it’s too likely to have side effects, and it doesn’t convey the idea that the r…

You could also redirect to the url with the query string dropped.

But then it’s barely a protest.

Re: I’ve banned query strings

#218
post #179

I love the hilarious output. He even coded in a special case for just a question mark without any params: https://chrismorgan.info/no-query-strings ? Never have I seen such a sassy web server

You exposed a (useful) quirk in HN's URL parsing, though... :p

https://chrismorgan.info/no-query-strings?>

Re: I’ve banned query strings

#219
post #179

I love the hilarious output. He even coded in a special case for just a question mark without any params: https://chrismorgan.info/no-query-strings ? Never have I seen such a sassy web server

I also contemplated making it serve the content of the original page, but with every . and ! turned to ? (or maybe ! changed to ‽). But I decided that was too hard at present. I might revisit it later, there’s a stage in my plans where that will be easier to implement.

Re: I’ve banned query strings

#220

Earlier quoted context omitted.

> other parts of the stack As a web developer, you’re the like the guy standing with a clipboard outside a fancy club checking if people requesting entry are allowed or not. Basically, level 1 security. If someone is not on the list, your job is to default to declining them access, not granting them access assuming level 2 security will handle them at a deeper layer. It’s possible that the teams you work with expect…

>It’s possible that the teams you work with expect fuzzy behaviour from the website but that’s a choice, not a practice. This is how the vast majority of websites work. The practical reason is obvious: when we model the behaviour our code depends on, we want to create the simplest possible model that allows our code to work as expected. Placing requirements on it that our code doesn't actually depend on is useless, u…

> there is no security benefit to filtering out unneeded url parameters.

there is - security in depth.

If a url parameter would've been a vulnerability because something lower down the stack misinterprets it (and the param wasn't necessary for your app in the first place), then you've just left a window open for the exploit.

If the set of url params are known ahead of time (which i claim should be true), then you could make adding unknown params an error.

Post reply on HN