Web Fundamentals WHATWG URL Standard Routing & Architecture

URLs & Domains in Modern Full Stack Development

A URL is the universal address system of the web. Learn how browsers dissect URLs, how domain names translate through DNS into cloud infrastructure, how frontend and backend routers parse dynamic path parameters, how query strings drive API filtering, and why sensitive credentials must never be exposed in a URL.

Spec: WHATWG URL Standard & RFC 9110
Routing: Dynamic Routes & URLSearchParams
Est. Time: 45–60 Minutes

1. What is a URL?

Uniform Resource Locator: the address contract of the web

A URL (Uniform Resource Locator) is a standardized string that tells a client (such as a web browser or mobile application) exactly how to reach a resource,which server hosts it, and what specific asset or view is being requested.

🌐 The 5 Core Questions a URL Answers:
1. Scheme: How do I talk to it? (e.g. https:// for secure TLS)
2. Host: Which server holds it? (e.g. shop.example.com)
3. Path: Which application route or resource? (e.g. /products/42)
4. Query: What custom filters or modifiers apply? (e.g. ?category=laptop)
5. Fragment: Which on-page section should the browser scroll to? (e.g. #reviews)

2. 🔥 Interactive URL Anatomy Explorer

Click any segment of the URL below to inspect its WHATWG technical role

https://shop.example.com/products/42?category=laptop&sort=price#reviews
Pathname (/products/42)
✓ Transmitted to Server
Identifies the specific application route or resource. In modern full-stack web apps, /products/:id routes dynamically to a product controller, not a physical file on disk.

3. Domain vs. Hostname vs. URL

Clarifying the distinction between addressing hosts and locating resources

Domain Name

An identifier within the DNS hierarchy representing an organization or service namespace (e.g. example.com).

Hostname

The specific network host being contacted, which combines the subdomain and domain (e.g. api.example.com or www.example.com).

Full URL

The complete locator specifying scheme, hostname, port, pathname, query parameters, and fragment (e.g. https://api.example.com/products/42?sort=price).

4. From Domain to Server: The DNS Pipeline

How human-readable domains resolve into network connections

1. Domain Input
shop.example.com
2. DNS Lookup
A / CNAME Record
3. IP Address
104.21.48.92 (CDN/LB)
4. Backend Server
Node / Next / Express
💡 Engineering Reality Check: DNS does not store the website files! It simply points hostnames to IP addresses. In modern production environments, one domain rarely maps to a single physical computer; it typically points to Cloudflare/AWS CDNs or load balancers that distribute incoming requests among dozens of server containers.

5. 🔥 Live Query Parameter Lab (URLSearchParams)

Manipulate filter, sort, and pagination parameters in real-time

Generated URL: /products?category=laptop&sort=price_asc&q=macbook
⚡ Backend Parsing: In Express or Next.js, these values are automatically parsed:req.query.category,req.query.sort,req.query.page.

6. URL Percent-Encoding: Handling Spaces & Symbols

Why user input must be escaped before appending to a URL

URLs are restricted to specific ASCII characters. If a user searches for red shoes & boots, spaces and ampersands must be percent-encoded so they don't break the URL syntax:

Raw User Query:
"red shoes & boots"
Percent-Encoded URL:
/search?q=red%20shoes%20%26%20boots

7. The Fragment Identifier (#): Client-Side Only!

The vital difference between server targets and browser anchors

Consider the URL https://example.com/docs#installation:

Browser Address Bar

https://example.com/docs#installation

The browser reads #installation and automatically scrolls to the DOM element with id="installation".

HTTP Request Wire Target

GET /docs HTTP/1.1

The fragment is stripped out by the browser engine before transmitting across the network. The backend server never sees the hash!

8. 🔥 Live Dynamic URL Routing Simulator

Test how application routers extract dynamic parameters from URL paths

Presets:

9. Security Rules: What NEVER Belongs in a URL

Preventing catastrophic data leaks in browser history and server logs

🚨 Golden Rule: Never put secrets in URLs!
BAD: https://example.com/api/reset?password=mySecret123&apiKey=sk_live_9921
WHY: URLs are saved in plaintext across browser history, browser caches, corporate proxy logs, load balancer access logs, and transmitted in the HTTP Referer header to external websites. Always transmit sensitive secrets inside the encrypted HTTPS request body or authorization headers.

10. 🔥 Final Full-Stack Challenge: E-Commerce URL Architect

Match each e-commerce requirement with its optimal modern URL design

1. View details for product with unique ID 42:
2. Filter catalog for gaming laptops on page 3:
3. Access user #42's past order history:
4. Dedicated backend API endpoint for product 42:

11. Common URL & Domain Pitfalls

Critical misconceptions to avoid in full-stack architecture

1. Thinking URL and domain are synonyms: A domain is merely the hostname identifier (example.com); the URL encompasses scheme, path, query, and fragment.
2. Expecting the server to see the fragment (#): The hash fragment is never sent in HTTP requests; it is purely client-side.
3. Putting passwords or API keys in query parameters: URLs get logged in plaintext in server logs, proxy logs, and browser history. Never place secrets in URLs.

12. Knowledge Check Quiz

Validate your URLs, domains, routing, and parameter mastery

TEST YOUR KNOWLEDGE

URLs & Domains Architecture Knowledge Check

Validate your understanding of URL anatomy, DNS resolution, query parameters, routing, and URL security.

Question 1 of 4Current Score: 0 / 0
Q1

When a user navigates to https://example.com/docs#installation, which part of the URL is sent to the server in the HTTP request line?

13. Key Takeaways Checklist

Core concepts you have mastered in this module

URL = Scheme + Hostname + Pathname + Query + Fragment.
DNS translates hostnames to IPs; it does not store website files.
Paths map dynamically to application routes (:id), not disk files.
Query strings (?key=val&k2=v2) handle filtering, sorting, and pagination.
Fragment (#hash) is client-only and is never sent over the HTTP wire.
Never place sensitive passwords or secret API keys in URLs.