Web-Tool.net

URL query / fragment / refresh state

Separate query, fragment and reload boundaries

Use fixed examples to distinguish values sent to a server from values kept in the browser. No user URL is accepted, and this page does not navigate, fetch, store or send.

See the decisionsSave a review note

Five URL state boundaries

A query travels with an HTTP request; a fragment is not included in the initial request. Record reload and sharing behavior separately.

query → server-visible / fragment → browser-only
AxisReview
querySeparate request-visible values from server ownership.
fragmentBrowser-side state excluded from the initial HTTP request.
encodedKeep the displayed string separate from decoding responsibility.
reload/shareCheck what stays in the address bar and what reload restores.
secret-likeDo not put secrets in shared URLs; stop on the risky case.

Safe review order

  1. Record query and fragment separately with fixed examples.
  2. Keep encoded text separate from the receiver's decoding responsibility.
  3. Specify what reload and sharing preserve.
  4. Hold secret-like values locally instead of putting them in a URL.

This page uses synthetic cases only. It does not parse a user URL, send data, store data or rewrite the URL.

Five fixed cases

casefixed exampledecision
query-server-visible/search?q=alphaquery is server-visible
fragment-browser-only/app#tab=detailsfragment is browser-only
encoded-query-boundary/search?q=a%2Bb%20creview encoded value ownership
reload-share-boundary/app?tab=results#focus=priceseparate query and fragment on reload/share
fragment-secret-risk/app#token=<redacted>hold secret-like values