RFC 5147

URI Fragment Identifiers for the text/plain Media Type

๐Ÿ“… published April 2008, from ietf

RFC 5147 ๐ŸŽ€

URI Fragment Identifiers for the text/plain Media Type ๐Ÿ’–

okay bestie, this one is a Standards Track doc from April 2008 ๐Ÿ“…. It was written by E. Wilde (UC Berkeley) and M. Duerst (Aoyama Gakuin University) ๐Ÿฆ‹. It updates RFC 2046 and doesn't obsolete anything ๐ŸŒธ. So it's basically a glow-up for the text/plain media type, not a replacement.


Status of This Memo โœจ

so this document is a proper Internet standards track protocol for the Internet community, and it's asking everyone for discussion and suggestions for improvements ๐Ÿซถ. if you want the official standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) ๐Ÿ“š. and yes, distribution of this memo is unlimited ๐ŸŒˆ.

Abstract ๐Ÿ”ฎ

this memo defines URI fragment identifiers for text/plain MIME entities ๐Ÿ’…. these fragment identifiers let you point at parts of a text/plain MIME entity, either by character position or range, or by line position or range ๐Ÿงš. they can also carry integrity check info so they're more robust ๐Ÿ”ฅ. literally iconic.

Table of Contents ๐Ÿ—‚๏ธ

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1.  What Is text/plain?  . . . . . . . . . . . . . . . . . . .  3
     1.2.  What Is a URI Fragment Identifier? . . . . . . . . . . . .  4
     1.3.  Why text/plain Fragment Identifiers? . . . . . . . . . . .  4
     1.4.  Incremental Deployment . . . . . . . . . . . . . . . . . .  5
     1.5.  Notation Used in This Memo . . . . . . . . . . . . . . . .  5
   2.  Fragment Identification Methods  . . . . . . . . . . . . . . .  5
     2.1.  Fragment Identification Principles . . . . . . . . . . . .  6
       2.1.1.  Positions and Ranges . . . . . . . . . . . . . . . . .  6
       2.1.2.  Characters and Lines . . . . . . . . . . . . . . . . .  7
     2.2.  Combining the Principles . . . . . . . . . . . . . . . . .  7
       2.2.1.  Character Position . . . . . . . . . . . . . . . . . .  7
       2.2.2.  Character Range  . . . . . . . . . . . . . . . . . . .  8
       2.2.3.  Line Position  . . . . . . . . . . . . . . . . . . . .  8
       2.2.4.  Line Range . . . . . . . . . . . . . . . . . . . . . .  8
     2.3.  Fragment Identifier Robustness . . . . . . . . . . . . . .  8
   3.  Fragment Identification Syntax . . . . . . . . . . . . . . . .  9
     3.1.  Integrity Checks . . . . . . . . . . . . . . . . . . . . .  9
   4.  Fragment Identifier Processing . . . . . . . . . . . . . . . . 10
     4.1.  Handling of Line Endings in text/plain MIME Entities . . . 10
     4.2.  Handling of Position Values  . . . . . . . . . . . . . . . 11
     4.3.  Handling of Integrity Checks . . . . . . . . . . . . . . . 11
     4.4.  Syntax Errors in Fragment Identifiers  . . . . . . . . . . 12
   5.  Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
   6.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 13
   7.  Security Considerations  . . . . . . . . . . . . . . . . . . . 13
   8.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 14
     8.1.  Normative References . . . . . . . . . . . . . . . . . . . 14
     8.2.  Informative References . . . . . . . . . . . . . . . . . . 14
   Appendix A.  Acknowledgements  . . . . . . . . . . . . . . . . . . 16

1. Introduction โœจ

okay so this memo updates the text/plain media type defined in RFC 2046 [3] by adding URI fragment identifiers for text/plain MIME entities ๐Ÿฆ‹. the whole point is that you can refer to parts of a text/plain MIME entity ๐Ÿ’œ. those parts can be identified by character position or range, or by line position or range ๐Ÿ“. you can also attach integrity checking info to a fragment identifier, so applications can detect when the entity has changed ๐Ÿ‘€. main character energy.

this section is the intro to the basic concepts of text/plain MIME entities and URI fragment identifiers, and it talks about why we even need fragment identifiers for text/plain plus some deployment stuff ๐ŸŒธ. Section 2 covers the principles and methods the memo is built on. Section 3 defines the syntax, and Section 4 explains how to process text/plain fragment identifiers. Section 5 has examples ๐Ÿงš.

1.1. What Is text/plain? ๐Ÿ“„

okay so Internet Media Types (often called "MIME types"), as defined in RFC 2045 [2] and RFC 2046 [3], are used to label different types and sub-types of media ๐ŸŽ€. RFC 2046 [3] and RFC 3676 [6] specify the text/plain media type, which is for simple, unformatted text ๐Ÿ’…. quoting RFC 2046 [3] directly: "Plain text does not provide for or allow formatting commands, font attribute specifications, processing instructions, interpretation directives, or content markup. Plain text is seen simply as a linear sequence of characters, possibly interrupted by line breaks or page breaks". it's giving pure, no-frills vibes ๐Ÿค.

the text/plain media type doesn't restrict the character encoding, so any character encoding can be used ๐ŸŒˆ. if there's no explicit character encoding declaration, US-ASCII [13] is assumed as the default ๐Ÿ“. this is the tricky part: because the encoding can vary, you can't count characters in a text/plain MIME entity without taking the encoding into account ๐Ÿ™ˆ. lots of encodings use more than one octet per character, so counting octets and counting characters are not the same thing bestie ๐Ÿ’€.

the biggest perk of text/plain MIME entities is how easy they are to use and how portable they are across platforms ๐Ÿซถ. as long as they use popular encodings (like US-ASCII or UTF-8 [12]), they can be displayed and processed on basically every computer system โœจ. the only interoperability issue left is how line endings are represented, which is covered in Section 4.1 ๐Ÿ”ฅ.

1.2. What Is a URI Fragment Identifier? ๐Ÿ”—

so URIs are the identification mechanism for resources on the Web ๐ŸŒ. the URI syntax in RFC 3986 [7] can optionally include a so-called "fragment identifier", which is separated by a number sign ('#') ๐Ÿ’œ. the fragment identifier is extra reference info that the user agent interprets after the retrieval action has finished successfully ๐Ÿงš. the semantics of a fragment identifier belong to the data that comes back from the retrieval, no matter what type of URI was used in the reference ๐Ÿ‘‘. so the format and interpretation of a fragment identifier depends on the media type of the retrieval result ๐Ÿ’….

the most popular fragment identifier is the one defined for text/html (in RFC 2854 [10]), which lets you refer to a specific element (identified by the value of a 'name' or 'id' attribute) of an HTML document ๐ŸŒธ. that means you can point at one specific part of a web page instead of the whole thing ๐Ÿฆ‹.

1.3. Why text/plain Fragment Identifiers? ๐Ÿค”

referring to specific parts of a resource is super useful because it lets users and applications make more specific references โœจ. people can point at the exact part they're actually interested in or want to talk about, instead of always linking the whole resource ๐Ÿ’–. even though it's suggested that fragment identification methods get specified in a media type's MIME registration (see [15]), lots of media types don't have any fragment identification methods attached ๐Ÿ™ˆ.

fragment identifiers only help if the client supports them, because only the client interprets them ๐Ÿ“ฑ. so a new fragment identification method takes time to get adopted, and older clients won't support it at all ๐Ÿ˜ญ. but here's the thing: the URI still works even if the fragment identifier isn't supported (the resource gets retrieved, the fragment just isn't interpreted), so rapid adoption isn't super critical for a new method to succeed ๐Ÿซถ.

the fragment identifiers for text/plain in this memo let you refer to specific parts of a text/plain MIME entity using positions and ranges, which can apply to characters and lines ๐ŸŽ€. so people can share info more precisely, which cuts down on the time and effort spent manually hunting for the relevant part of a text/plain MIME entity ๐Ÿ’….

the text/plain format doesn't support embedding links, so in most environments text/plain resources can only be link targets, not link sources ๐Ÿฅบ. but if you combine these text/plain fragment identifiers with out-of-line linking mechanisms like XLink [14], you can "bind" link resources to text/plain resources and basically "embed" links into them ๐Ÿงš. so the fragment identifiers in this memo open the door for text/plain files to become bidirectionally navigable resources in hypermedia systems like the Web ๐ŸŒˆ. the glow-up is real.

1.4. Incremental Deployment ๐Ÿš€

until text/plain fragment identifiers are supported everywhere, it's important to think about what incremental deployment means ๐Ÿง. clients (like Web browsers) that don't support the text/plain fragment identifier from this memo will still work with URI references to text/plain MIME entities, but they won't be able to locate the sub-resource the fragment identifier points to ๐Ÿ˜ญ. this is a reasonable fallback, and in general users should keep in mind that a program interpreting a given URI might fail to interpret the fragment identifier part ๐Ÿ™ˆ. fragment identifier evaluation happens locally on the client, after the MIME entity has been retrieved, so there's no reliable way for a server to tell whether a requesting client is using a URI with a fragment identifier ๐Ÿ‘€. no cap, that's a lot of info for one little '#' ๐Ÿ’€.

1.5. Notation Used in This Memo ๐Ÿ“

the capitalized key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [4] ๐Ÿซถ. these are the official requirement words, so pay attention to them bestie ๐Ÿ”ฅ.

2. Fragment Identification Methods ๐Ÿ’Ž

the way you identify fragments of text/plain MIME entities can be based on different foundations ๐Ÿงฉ. because you can't insert explicit, invisible identifiers into a text/plain MIME entity (the way HTML does with dedicated attributes), fragment identification has to rely on inherent properties of the MIME entity itself ๐Ÿ™ƒ. this memo specifies fragment identification with four different methods: character positions and ranges, and line positions and ranges, plus an integrity check mechanism that makes fragment identifiers more robust ๐Ÿ›ก๏ธ.

when you interpret character or line numbers, implementations MUST take the character encoding of the MIME entity into account, because character count and octet count can differ depending on the encoding being used ๐Ÿšจ. for example, a MIME entity using UTF-16 (as specified in RFC 2781 [11]) uses two octets per character in most cases, and sometimes four ๐Ÿ˜ต. it can also have a leading BOM (Byte-Order Mark), which doesn't count as a character, so it also changes how a simple octet count maps to a character count ๐ŸŽ€.

2.1. Fragment Identification Principles ๐ŸŒŸ

fragment identification can be done by combining two orthogonal principles: positions and ranges, and characters and lines ๐Ÿ’ซ. this section describes the principles themselves, and Section 2.2 describes how they combine ๐Ÿฆ‹.

That's the first half, bestie. More parts are coming, so stay tuned ๐ŸŒˆ๐Ÿ’–

2.1.1. Positions and Ranges โœจ

okay so a position isn't an actual chunk of the MIME entity ๐Ÿ’… it's a spot inside it, which you can think of as a fragment of length zero ๐Ÿฆ‹ the main use case is pointing at a place for stuff like "insert some text here," where you need a spot and not a chunk. Positions are counted from zero, with position zero sitting right before the first character or line of a text/plain MIME entity. So a text/plain entity with one character has two positions: one before it (zero) and one after it (1) ๐ŸŒธ

Since positions have zero length, there's nothing to highlight, so applications SHOULD use other methods than highlighting to show them. The most obvious move is a cursor (if the app even does cursors) ๐Ÿ’–

Ranges are the opposite vibe ๐ŸŽ€ they cover fragments that can be longer than zero. Ranges always have a lower and an upper bound. You can leave out the start or the end, and they'll default to the first or last position of the MIME entity. The end has to be greater than or equal to the start. A range with the same start and end is totally legal and covers a length of zero, which just makes it the same as a position ๐Ÿงš

Apps that support highlighting SHOULD use it to show the user any fragment longer than zero ๐Ÿ”ฅ

For both positions and ranges, it's implicitly assumed that if a number is bigger than the actual number of elements in the MIME entity, it's pointing at the last element (see Section 4 for details) ๐Ÿ™ˆ

2.1.2. Characters and Lines ๐Ÿ“

Positions and ranges work for characters or lines. In both cases, positions are points between things, while ranges cover zero or more of those things by using positions ๐Ÿ’œ

Character positions also start at zero. Initial BOM marks (and similar stuff that isn't really textual content) get ignored. Every character counts separately, EXCEPT line endings, which always count as one character (see Section 4.1 for details) ๐Ÿ’…

Line positions start at zero too, and line position zero is always the same spot as character position zero. Section 4.1 explains how line endings get identified ๐ŸŒˆ Fragments identified by lines include their line endings, so apps working with line-based fragments MUST include the line endings in the fragment identification they're using (e.g., the highlighted selection) ๐Ÿซถ And if a MIME entity has no line endings at all, it's just one single (the first) line ๐Ÿฆ‹

2.2. Combining the Principles โœจ

Okay, now we mix the positions/ranges and characters/lines principles together ๐Ÿ’– That gives us four use cases. The schemes mentioned below refer to the fragment identifier syntax, which we'll get into properly in Section 3 ๐ŸŽ€

2.2.1. Character Position ๐ŸŒธ

To point at a character position (a zero-length fragment between two characters), you use the char scheme followed by a single number ๐Ÿฆ‹ It identifies a spot between two characters (or before the first or after the last one), not a fragment made of several characters. Counting starts at zero, so the spot before the first character is character position zero. A MIME entity with n distinct characters has n+1 distinct character positions, and the last one is character position n ๐Ÿงš

2.2.2. Character Range ๐Ÿ’œ

To grab a fragment of one or more characters (a character range), you use the char scheme followed by a range specification ๐Ÿ’… A character range is one continuous region of the MIME entity, running from the starting character position of the range to its ending character position โœจ

2.2.3. Line Position ๐Ÿ“

To point at a line position (a zero-length fragment between two lines), you use the line scheme followed by a single number ๐Ÿซถ It identifies a spot between two lines (or before the first or after the last one), not a fragment made of several lines. Counting starts at zero, so the spot before the first line is line position zero. A MIME entity with n distinct lines has n+1 distinct line positions, and the last one is line position n ๐ŸŒˆ

2.2.4. Line Range ๐Ÿ”ฅ

To grab a fragment of one or more lines (a line range), you use the line scheme followed by a range specification ๐Ÿ‘‘ A line range is one continuous region of the MIME entity, running from the starting line position of the range to its ending line position ๐Ÿ’–

2.3. Fragment Identifier Robustness ๐Ÿ›ก๏ธ

Bestie, it's super easy for a change to the referenced resource to break a fragment identifier ๐Ÿ˜ญ If apps want sturdier fragment identifiers, they can add integrity-check information to them. That info is used to detect changes in the resource, so apps can warn users that a fragment identifier might have been broken by a modification ๐ŸŽ€

Fragment identifiers are interpreted by clients, so integrity-check information is defined on MIME entities rather than on the resource itself. That means the integrity-check info is specific to one particular entity. Specifically, content encodings and/or content transfer encodings must be removed before using integrity-check information ๐Ÿ’…

Integrity-check information may specify the character encoding that was used when it was created. If that's present, clients MUST check whether the character encoding specified and the character encoding of the retrieved MIME entity are equal, and clients MUST NOT use the integrity check information if they differ. Clients MAY choose to transcode the retrieved MIME entity when the character encodings differ, and after doing so, apply integrity checks. Please note that this method is inherently unreliable, because certain characters or character sequences may have been lost or normalized due to restrictions in one of the character encodings used ๐Ÿฅบ

3. Fragment Identification Syntax ๐ŸŒธ

The syntax for text/plain fragment identifiers is super straightforward ๐Ÿงš It defines four schemes: 'char', 'line', and integrity check (which can be either 'length' or 'md5'). The 'char' and 'line' schemes each come in two variants: the position variant (with a single number) and the range variant (with two comma-separated numbers). An integrity check can use either the 'length' or the 'md5' scheme to specify a value. In this case, 'length' is a very weak but easy-to-calculate integrity check ๐Ÿฆ‹

The following syntax definition uses ABNF as defined in RFC 5234 [9], including the rules DIGIT and HEXDIG. The mime-charset rule is defined in RFC 2978 [5] ๐Ÿ’œ

NOTE: In the descriptions that follow, specified text values MUST be used exactly as given, using exactly the indicated lower-case letters. In this respect, the ABNF usage differs from [9]. โš ๏ธ
text-fragment   =  text-scheme 0*( ";" integrity-check )
text-scheme     =  ( char-scheme / line-scheme )
char-scheme     =  "char=" ( position / range )
line-scheme     =  "line=" ( position / range )
integrity-check =  ( length-scheme / md5-scheme )
                     [ "," mime-charset ]
position        =  number
range           =  ( position "," [ position ] ) / ( "," position )
number          =  1*( DIGIT )
length-scheme   =  "length=" number
md5-scheme      =  "md5=" md5-value
md5-value       =  32HEXDIG

3.1. Integrity Checks ๐Ÿ”

An integrity check can specify either a MIME entity's length or its MD5 fingerprint ๐Ÿ’– In both cases, it can optionally specify the character encoding used when calculating the check, so clients that interpret the fragment identifier can confirm they're using the same encoding for their own calculations ๐ŸŽ€ For lengths, the character encoding matters because it can change the character count. For example, Unicode has precomposed characters for writing Vietnamese, but in the windows-1258 encoding (also used for Vietnamese), some characters have to be encoded with separate diacritics, so two characters get counted instead of one ๐ŸŒˆ In Unicode terminology, that means the length of a text/plain MIME entity is computed based on its "code points" ๐Ÿง  For MD5 fingerprints, the encoding matters because the MD5 algorithm works on the binary representation of the text/plain resource ๐Ÿซถ

To let future versions of this specification keep up with cryptography developments, implementations MUST ignore new types of integrity checks whose names are other than 'length' and 'md5' ๐Ÿ›ก๏ธ If several integrity checks are present, an application can use whichever ones it understands, and among those, the ones that give it a good balance between performance and the need for integrity checking ๐Ÿ’… Please see Section 4.3 for further details โœจ

The length of a text/plain MIME entity is calculated using the principles defined in Section 2.1.2 ๐Ÿฆ‹ The MD5 fingerprint of a text/plain MIME entity is calculated using the algorithm presented in [1], and the result is encoded as 32 hexadecimal digits (uppercase or lowercase letters, either is fine) representing the 128 bits produced by MD5 ๐Ÿ’œ Calculating integrity checks happens after stripping any potential content-encodings or content-transfer-encodings of the transport mechanism ๐ŸŒธ

4. Fragment Identifier Processing ๐Ÿ‘‘

Applications implementing support for the mechanism described in this memo MUST behave as described in the following sections ๐Ÿ’–

4.1. Handling of Line Endings in text/plain MIME Entities โœจ

Okay so, in Internet messages, line endings in text/plain MIME entities are CR+LF character sequences (see RFC 2046 [3] and RFC 3676 [6]) ๐Ÿ’Œ. But some protocols (like HTTP) also allow other conventions for line endings, and different operating systems save text/plain entities locally with their own line endings. Unix uses LF, MacOS traditionally uses CR, and Windows uses CR+LF ๐Ÿ–ฅ๏ธ. Total chaos, honestly.

No matter how many bytes or characters a line ending takes up, each line ending MUST be counted as one single character ๐ŸŽ€. Implementations that interpret text/plain fragment identifiers MUST take into account the line ending conventions of the protocols and other contexts they work in ๐Ÿซถ.

For example, an implementation working in a Web browser that supports http: URIs has to support the various line ending conventions permitted by HTTP ๐ŸŒ. An implementation used on local files (for example with the file: URI scheme) has to support the conventions used for local storage ๐Ÿ“. All implementations SHOULD support the Internet-wide CR+LF line ending convention, and they MAY support additional conventions that aren't related to the protocols or systems they work with ๐Ÿ’….

Implementers should be aware that line endings in plain text entities can be represented by other characters or character sequences than CR+LF ๐Ÿ‘€. Besides the CR and LF we just talked about, there are also NEL and CR+NEL ๐Ÿฆ‹. The encoding of line endings can also depend on the character encoding of the MIME entity, so implementations have to take this into account where necessary ๐ŸŒธ.

4.2. Handling of Position Values ๐Ÿงš

If any position value (as a position or as part of a range) is greater than the length of the actual MIME entity, it identifies the last character position or line position of the MIME entity ๐Ÿ“. If the first position value in a range isn't present, the range extends from the start of the MIME entity ๐Ÿ. If the second position value in a range isn't present, the range extends to the end of the MIME entity ๐Ÿ”š. And if a range scheme's positions aren't properly ordered (meaning the first number is less than the second), the fragment identifier MUST be ignored ๐Ÿ™…โ€โ™€๏ธ.

4.3. Handling of Integrity Checks ๐Ÿ”

Clients are not required to implement the handling of integrity checks, so they MAY choose to ignore integrity check information altogether ๐Ÿคทโ€โ™€๏ธ. But if they do implement integrity checking, here's the tea:

If a fragment identifier contains one or more integrity checks, and a client retrieves a MIME entity and, using some integrity check(s), detects that the entity has changed (observing the character encoding specification as described in Section 3.1, if present), then the client SHOULD NOT interpret the text/plain fragment identifier ๐Ÿšซ. A client MAY signal this situation to the user ๐Ÿ“ฃ.

4.4. Syntax Errors in Fragment Identifiers ๐Ÿ™ˆ

If a fragment identifier has a syntax error (meaning it doesn't conform to the syntax specified in Section 3), it MUST be ignored by clients ๐Ÿ—‘๏ธ. Clients MUST NOT make any attempt to correct or guess fragment identifiers, no exceptions ๐Ÿ’€. Syntax errors MAY be reported by clients ๐Ÿ“.

5. Examples ๐ŸŒˆ

The following examples show some usages for the fragment identifiers defined in this memo. Let's go!! ๐ŸŽ‰

http://example.com/text.txt#char=100

This URI identifies the position after the 100th character of the text.txt MIME entity. It should be noted that it is not clear which octet(s) of the MIME entity this will be without retrieving the MIME entity and thus knowing which character encoding it is using (in case of HTTP, this information will be given in the Content-Type header of the response) ๐Ÿค”. If the MIME entity has fewer than 100 characters, the URI identifies the position after the MIME entity's last character ๐Ÿณ๏ธ.

http://example.com/text.txt#line=10,20

This URI identifies lines 11 to 20 of the text.txt MIME entity ๐Ÿ“–. If the MIME entity has fewer than 11 lines, it identifies the position after the last line ๐Ÿซ . If the MIME entity has less than 20 but at least 11 lines, it identifies the range from line 11 to the last line of the MIME entity โœจ.

https://example.com/text.txt#line=,1

This URI identifies the first line. Please note that the URI scheme has been changed to https ๐Ÿ”’.

ftp://example.com/text.txt#line=10,20;length=9876,UTF-8

Same energy as the second example: this URI identifies lines 11 to 20 of the text.txt MIME entity ๐Ÿ’œ. The additional length integrity check specifies that the MIME entity has a length of 9876 characters when encoded in UTF-8 ๐Ÿ”ข. If the client supports the length scheme, it may test the retrieved MIME entity for its length, but only if the retrieved MIME entity uses the UTF-8 encoding or has been locally transcoded into this encoding ๐Ÿง.

Heads up, bestie: the FTP protocol, as well as some other protocols underlying some other URI schemes, don't provide explicit information about the media type of the resource being retrieved. Using fragment identifiers with such URI schemes is therefore inherently unreliable ๐Ÿ˜ญ. Current user agents use various heuristics to infer some media type for further processing. Processing of the fragment identifier according to this memo is only appropriate if the inferred media type is text/plain ๐ŸŽ€.

6. IANA Considerations ๐Ÿ›๏ธ

IANA has added a reference to this specification in the text/plain Media Type registration ๐Ÿ“š.

7. Security Considerations ๐Ÿ”

Okay, this section is serious, so listen up ๐Ÿ‘‚. The fact that software implementing fragment identifiers for plain text and software not implementing them behaves differently, and the fact that different software may show documents or fragments to users in different ways, can lead to misunderstandings on the part of users ๐Ÿ˜ต. Such misunderstandings might be exploited in a way similar to spoofing or phishing ๐ŸŽฃ.

In particular, care has to be taken if fragment identifiers are used together with a mechanism that allows showing only the part of a document identified by a fragment ๐Ÿ•ต๏ธโ€โ™€๏ธ. One scenario may be the use of a fragment identifier to hide small-print legal text ๐Ÿ“œ. Another scenario may be the inclusion of site-key-like material, which may give the user the impression of using the real site rather than a fake site ๐Ÿšจ. Other scenarios may also be possible ๐Ÿซฃ. Possible countermeasures may include but are not limited to displaying the included content within clearly visible boundaries, and limiting inclusion to material from the same security realm or from realms that give explicit permission to be included in another realm ๐Ÿ›ก๏ธ.

Please note that the above issues all apply to the client side. Fragment identifiers are not used when resolving a URI to retrieve the representation of a resource, and are only applied on the client side ๐Ÿ’ป.

Implementers and users of fragment identifiers for plain text should also be aware of the security considerations in RFC 3986 [7] and RFC 3987 [8] ๐Ÿ”.

8. References ๐Ÿ“š

8.1. Normative References

[1] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992.

[2] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies", RFC 2045, November 1996.

[3] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types", RFC 2046, November 1996.

[4] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[5] Freed, N. and J. Postel, "IANA Charset Registration Procedures", BCP 19, RFC 2978, October 2000.

[6] Gellens, R., "The Text/Plain Format and DelSp Parameters", RFC 3676, February 2004.

[7] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005.

[8] Duerst, M. and M. Suignard, "Internationalized Resource Identifiers (IRI)", RFC 3987, January 2005.

[9] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, January 2008.

8.2. Informative References

[10] Connolly, D. and L. Masinter, "The 'text/html' Media Type", RFC 2854, June 2000.

[11] Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646", RFC 2781, February 2000.

[12] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.

[13] ANSI X3.4-1986, "Coded Character Set - 7-Bit American National Standard Code for Information Interchange", 1986.

[14] DeRose, S., Maler, E., and D. Orchard, "XML Linking Language (XLink) Version 1.0", World Wide Web Consortium Recommendation, June 2001, <http://www.w3.org/TR/xlink/>.

[15] Freed, N. and J. Klensin, "Media Type Specifications and Registration Procedures", BCP 13, RFC 4288, December 2005.

Appendix A. Acknowledgements ๐Ÿ’–

Huge thanks to everyone who gave comments and suggestions: Marcel Baschnagel, Stephane Bortzmeyer, Tim Bray, Iain Calder, John Cowan, Spencer Dawkins, Lisa Dusseault, Benja Fallenstein, Ted Hardie, Sam Hartman, Sandro Hawke, Jeffrey Hutzelman, Cullen Jennings, Graham Klyne, Dan Kohn, Henrik Levkowetz, Chris Newman, Mark Nottingham, Conrad Parker, and Tim Polk ๐Ÿซถ๐ŸŒธ.

Authors' Addresses ๐Ÿ–Š๏ธ

Erik Wilde
UC Berkeley
School of Information, 311 South Hall
Berkeley, CA 94720-4600
U.S.A.

Phone: +1-510-6432253
EMail: dret@berkeley.edu
URI:   http://dret.net/netdret/


Martin Duerst (Note: Please write "Duerst" with u-umlaut wherever
              possible, for example as "D&#252;rst" in XML and HTML.)
Aoyama Gakuin University
5-10-1 Fuchinobe
Sagamihara, Kanagawa  229-8558
Japan

Phone: +81 42 759 6329
Fax:   +81 42 759 6495
EMail: duerst@it.aoyama.ac.jp
URI:   http://www.sw.it.aoyama.ac.jp/D%C3%BCrst/

Copyright (C) The IETF Trust (2008).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. ๐Ÿ’…

Intellectual Property โœจ

okay so this bit is the legal stuff, but it's still important bestie ๐Ÿ’… The IETF is NOT saying whether the tech in this doc is valid, or how wide its scope is, or whether anyone has a license for any of those rights ๐Ÿ™ˆ It also doesn't claim it went looking for any of that stuff on its own. If you want the details on how rights work for RFC docs, the answers live in BCP 78 and BCP 79 ๐Ÿ“š Also, implementers or users who want copies of IPR disclosures sent to the IETF Secretariat, any assurances of licenses that are available, or the results of trying to get a general license or permission to use those proprietary rights can all be found in the IETF online IPR repository at http://www.ietf.org/ipr ๐Ÿซถ

And here's the big ask ๐Ÿ”ฅ If you know of any copyrights, patents, patent applications, or other proprietary rights that might cover tech you'd need to implement this standard, tell the IETF! Send it to ietf-ipr@ietf.org ๐Ÿ’œ Honestly it's giving community effort, and I love that for us ๐ŸŒˆ

๐Ÿ“ฆ where this page comes from