In HTTP(S) URLs, the
: (in its direct form) has these purposes:
- delimiter between scheme and hier-part (
- delimiter between host and port (
- (deprecated) delimiter between name and password in userinfo (
- in the host, it may be part of IP addresses
In the path, the query, and the fragment, the
: can be used to represent data. So there is no technical difference between a path like
/hello and a path like
In your example, it’s percent-encoded (as
%3A). Any percent-encoded character can appear in the path/query/fragment, where it represents data.
(Terminology based on the URI standard)
There is nothing problematic for security about
%3A in the path/query/fragment, compared to any other character that can appear there. Whatever could be done with
: (e.g., using it as prefix for a user tracking string) could as well be done with
What probably happens in your case (just a guess from observing the link/redirect, I have no experience with Disqus):
- When a user posts an external link, Disqus doesn’t link it directly. Instead, they link to their own service http://disq.us/, which then redirects to the original URL.
- Disqus adds the original URL as value for the
url parameter (to which it adds a cryptic string prepended by
:), and an ID as value for the
:-string is generated (and remembered) by Disqus (see point 3 for what it might be used).
cuid indicates the Disqus account of the site owner where the comment with the external link was published (probably for analytics purposes).
- For a specific original URL, the redirect only works if the disq.us URL contains the same
:-string that was generated when the original URL was first submitted. This could prevent that their redirect service gets used for URLs that were never posted in a comment.
So clicking this link can affect your privacy, even if you have disabled sending of the
- The linking site owner can know that you clicked their link.
- Disqus can know that you clicked this link (and on whose site, possibly also page).
- The linked site owner can know that you came from a link in a Disqus comment, and possibly also from which site/page (e.g., if the Disqus
cuid can be found in a search engine).
To prevent this, you could extract the
url parameter value, remove the last part prepended by (and including the)
%3A, and percent-decode the result once. This allows you to visit the linked document directly, without going through Disqus’ redirect service. This works as long they decide to include the target URL in their redirect URL (which they wouldn’t have to).