Live data from Hacker News

In search of the perfect URL validation regex (2010)

mathiasbynens.be

31–40 of 67 posts

Re: In search of the perfect URL validation regex (2010)

#31
post #5

@stephenhay seems to be the winner here if you don't need IP addresses (or weird dashed URLS). It's only 38 characters long and easy to understand. @^(https?|ftp)://[^\s/$.?#].[^\s]*$@iS The simpler the better, if you're going to use something that is not ideal.

Doesn’t cover mailto: which is fairly common. To be pedantic/strict, mailto: are URIs not URLs.

Re: In search of the perfect URL validation regex (2010)

#32

I was just struggling with this -- specifically, our users' "UX" expectation that entering "example.com" should work when asked for their website URL. Most URL validation rules/regex/librairies/etc. reject "example.com". However, if you head over to Stripe (for example), in the account settings, when asked for your company's URL, Stripe will accept "example.com", and assume " http:// " as the prefix (which yes, can h…

Parse, don’t validate. If you need a heuristic that accepts non-URL strings as if they were valid URLs, you should convert those non-URL strings to valid URLs so the rest of your code can just deal with valid URLs.

    if (validateURL(url)) {
      return url;
    } else if (validateURL("http://" + url)) {
      return "http://" + url;
    } else {
      return null;
    }

Re: In search of the perfect URL validation regex (2010)

#33
post #2

I was once failed on a technical interview, partly because on the coding test I was asked to write a url parser "from scratch, the way a browser would do it" and I explained it would take way too long to account for every edge case in the URL RFC but that I could do a quick and dirty approach for common urls. After I did this, the interviewer stopped me and told me in a negative way that he expected me to use a regex…

How do browsers parse URLs then?

There's actually a standard for it these days.

https://url.spec.whatwg.org/#url-parsing

Re: In search of the perfect URL validation regex (2010)

#35
post #2

I was once failed on a technical interview, partly because on the coding test I was asked to write a url parser "from scratch, the way a browser would do it" and I explained it would take way too long to account for every edge case in the URL RFC but that I could do a quick and dirty approach for common urls. After I did this, the interviewer stopped me and told me in a negative way that he expected me to use a regex…

Ya. I've also suffered copypasta trials administered by bar raisers, mensa members, and other self appointed keepers of the sacred nerd flame.

My imagined remedies are no 1:1 interviews and recording these sessions for "possible quality assurance and training purposes".

Re: In search of the perfect URL validation regex (2010)

#36
post #21

Even if you built a URL validation regex that follows rfc3986[1] and rfc3987[2], you will still get user bug reports because web browsers follow a different standard. For example, http://example.com./ > , http:///example.com/ > and https://en.wikipedia.org/wiki/Space (punctuation) > are classified as invalid urls in the blog, but they are accepted in the browser. As the creator of cURL puts it, there is no URL standa…

http://example.com./> is a valid URL, see for example:

https://jdebp.uk/FGA/web-fully-qualified-domain-name.html

Re: In search of the perfect URL validation regex (2010)

#38
post #2

I was once failed on a technical interview, partly because on the coding test I was asked to write a url parser "from scratch, the way a browser would do it" and I explained it would take way too long to account for every edge case in the URL RFC but that I could do a quick and dirty approach for common urls. After I did this, the interviewer stopped me and told me in a negative way that he expected me to use a regex…

Did you point out that his two requirements were contradictory?

Re: In search of the perfect URL validation regex (2010)

#39
post #21

Even if you built a URL validation regex that follows rfc3986[1] and rfc3987[2], you will still get user bug reports because web browsers follow a different standard. For example, http://example.com./ > , http:///example.com/ > and https://en.wikipedia.org/wiki/Space (punctuation) > are classified as invalid urls in the blog, but they are accepted in the browser. As the creator of cURL puts it, there is no URL standa…

There's also a question of what we're really trying to validate, IMHO. All of these regex patterns will tell you that a string looks like a URL, but they won't actually tell you if: There's any web server listening at that particular URL; Whether that server has the resource in that location; If that server is reachable from where you want to fetch it; etc.

Re: In search of the perfect URL validation regex (2010)

#40
post #36
post #21

Even if you built a URL validation regex that follows rfc3986[1] and rfc3987[2], you will still get user bug reports because web browsers follow a different standard. For example, http://example.com./ > , http:///example.com/ > and https://en.wikipedia.org/wiki/Space (punctuation) > are classified as invalid urls in the blog, but they are accepted in the browser. As the creator of cURL puts it, there is no URL standa…

http://example.com./ > is a valid URL, see for example: https://jdebp.uk/FGA/web-fully-qualified-domain-name.html

Tangentially, Youtube had a bug surface last year where adding that extra dot let you avoid all ads. Previous discussion[1]

[1] https://news.ycombinator.com/item?id=23479435

Post reply on HN