RFC 2397

The "data" URL scheme

📅 published August 1998, from ietf

RFC 2397: The "data" URL scheme 🎀

Okay bestie, this is the one where the "data" URL scheme gets defined. 💖 The Network Working Group put it out, written by Larry Masinter of Xerox Corporation 🧚. It's a Standards Track doc, dated August 1998, and the header doesn't list anything it obsoletes or updates. Cute and clean. ✨

Status of This Memo 🌸

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited. 💅

Copyright (C) The Internet Society (1998). All Rights Reserved.

1. Abstract ✨

So basically, a brand new URL scheme called "data" gets defined 🎀. It lets you include small chunks of data right there as "immediate" data, like it was pulled in from somewhere else. Iconic. 👑

2. Description 💅

Some apps that work with URLs also need to embed small media type data straight into the line, no cap 🍓. This doc defines a new URL scheme that acts kind of like "immediate addressing." The URLs look like this:

data:[<mediatype>][;base64],<data>

The <mediatype> is an Internet media type specification, and it can come with optional parameters. If you see ;base64, that means the data is base64 encoded 🫶. Without ;base64, the data (as a sequence of octets) gets represented with ASCII for octets inside the range of safe URL characters, and the standard %xx hex encoding of URLs for octets outside that range 🌈. If <mediatype> is left out, it defaults to text/plain;charset=US-ASCII. As a shorthand, you can drop text/plain but still supply the charset parameter ✨.

The "data:" URL scheme is only useful for short values, periodt 💀. Some apps that use URLs may have a length limit. For example, URLs inside <A> anchors in HTML have a length limit set by the SGML declaration for HTML [RFC1866] 🙈. The LITLEN (1024) limit caps the number of characters that can show up in a single attribute value literal. The ATTSPLEN (2100) limit caps the sum of all lengths of all attribute value specifications that appear in a tag. And the TAGLEN (2100) limit caps the overall length of a tag 🔥.

The "data" URL scheme has no relative URL forms. Not me being extra about it 💜.

3. Syntax 🧚

dataurl    := "data:" [ mediatype ] [ ";base64" ] "," data
mediatype  := [ type "/" subtype ] *( ";" parameter )
data       := *urlchar
parameter  := attribute "=" value

Here, "urlchar" is imported from [RFC2396], and "type", "subtype", "attribute" and "value" are the matching tokens from [RFC2045]. They get represented with URL escaped encoding from [RFC2396] whenever needed 🌸.

Attribute values in [RFC2045] can be tokens or quoted strings. Inside a "data" URL, though, the "quoted-string" form would be awkward, since the quote mark isn't a valid urlchar at all 😭. So for this reason, parameter values should use the URL Escaped encoding instead of a quoted string if the parameter values contain any "tspecial".

The ";base64" extension is easy to tell apart from a content-type parameter, because it doesn't have a following "=" sign 💖.

4. Examples 🍓

A data URL can be used for all kinds of data. Look at this one:

data:,A%20brief%20note

It encodes the text/plain string "A brief note", which could be handy in a footnote link 📝.

Here's an HTML fragment:

<IMG
SRC="data:image/gif;base64,R0lGODdhMAAwAPAAAAAAAP///ywAAAAAMAAw
AAAC8IyPqcvt3wCcDkiLc7C0qwyGHhSWpjQu5yqmCYsapyuvUUlvONmOZtfzgFz
ByTB10QgxOR0TqBQejhRNzOfkVJ+5YiUqrXF5Y5lKh/DeuNcP5yLWGsEbtLiOSp
a/TPg7JpJHxyendzWTBfX0cxOnKPjgBzi4diinWGdkF8kjdfnycQZXZeYGejmJl
ZeGl9i2icVqaNVailT6F5iJ90m6mvuTS4OK05M0vDk0Q4XUtwvKOzrcd3iq9uis
F81M1OIcR7lEewwcLp7tuNNkM3uNna3F2JQFo97Vriy/Xl4/f1cf5VWzXyym7PH
hhx4dbgYKAAA7"
ALT="Larry">

That can work as a small inline image in an HTML doc 🦋. (The embedded image is probably near the limit of usefulness. For anything bigger, data URLs are likely to be a bad fit 🙈.)

A data URL's media type spec can include other parameters too. For example, you could specify a charset parameter:

data:text/plain;charset=iso-8859-7,%be%fg%be

That's good for a short sequence of Greek characters 🌈.

Some apps might use the "data" URL scheme to hand over setup parameters to other kinds of networking apps 🧚. For instance, someone could create a media type called

application/vnd-xxx-query

whose content is a query string plus a database identifier for the "xxx" vendor's databases. A URL like this:

data:application/vnd-xxx-
query,select_vcount,fcol_from_fieldtable/local

could then be used in a local app to launch the "helper" for application/vnd-xxx-query and pass it the immediate data included 👑.

5. History ⭐

This idea was first proposed in August 1995 🎀. Some versions of the data URL scheme got used in defining VRML, and one version showed up as part of a proposal for embedded data in HTML 🌸. Changes were made based on requests, like eliding the media type, packing the base64 indication more tightly, and dropping "quoted printable" as an encoding. Quoted printable wouldn't easily give valid URLs without extra %xx encoding, which is already enough on its own 💅. The "data" URL scheme is in use in VRML, newer HTML applications, and various commercial products. It's also used for object parameters in Java and ActiveX applications 🔥.

6. Security 💀

Okay, this section is serious, so read it carefully bestie 🙈

Interpreting the data inside a "data" URL carries the same security considerations as any implementation of the given media type. An application should not interpret the contents of a data URL that's marked with a media type the application's configuration has disallowed for processing 🚨.

Sites that use firewall proxies to block retrieval of certain media types (like application script languages or types with known security problems) will find it hard to screen for those types being included through the "data" URL scheme 😭. Still, they should be aware of the threat and take whatever precautions they consider necessary within their domain 🔥.

The effect of using long "data" URLs in applications is currently unknown. Some software packages may show unreasonable behavior when they run into data that goes past their allocated buffer size 💀.

7. References 📚

  • [RFC2396] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax", RFC 2396, August 1998.
  • [RFC1866] Berners-Lee, T., and D. Connolly, "Hypertext Markup Language - 2.0.", RFC 1866, November 1995.
  • [RFC2045] Freed N., and N. Borenstein., "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996.

Author contact information:

  • Larry Masinter
  • Xerox Palo Alto Research Center
  • 3333 Coyote Hill Road
  • Palo Alto, CA 94304
  • EMail: masinter@parc.xerox.com

Copyright (C) The Internet Society (1998). All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. ✨

📦 where this page comes from