I was wondering if there are any security risks of having too long URLs for an internet site.

Of course there are things that don't matter if they're long or not, i.e. the actual hostname and filename, but I'm not so sure about queries and fragments in the URL. I actually once encountered a URL with over 900 characters.

Is there a rule of thumb saying that you should try to keep URLs as short as possible for security reasons or is it completely depending on the information that's transmitted in the URL?

  • Risk for whom? The client's browser (index out of bounds errors come to mind) or the server? Any decent server will have security measures to deal with crafted URL's anyway. – Marcel Jun 21 '19 at 8:32
  • I dont think there is a rule, depends on the processing of the URLs on the server side basically. – camp0 Jun 21 '19 at 8:35

Yes, they should be kept as short as possible (and within a reasonable limit for public readable URLs).

  • There are various vulnerabilities that only affect long URLs, for example: CVE-2017-1000100 - When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the un-truncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

There are other non-security or partial related to security vulnerabilities too:

  • Search engines, google included, have various limitations and will not function correctly if the URL is too long.

  • The Windows Server IIS maximum URL length is defined by the httpRuntimeSection.MaxUrlLength property. Its value is 260 characters. If exceeded, "The length of the URL for this request exceeds the configured maxUrlLength value" error will be generated.

  • HTTP/2 requests may fail with too-long URLs in some cases for PHP, Apache, Varnish.

|improve this answer|||||
  • 3
    I would tend to disagree with "should be kept as short as possible" if it harms usability. It depends on the use-case, and I would argue that "Should be kept within a reasonable limit" is probably better advice. /api/v2/messages/new is probably a more descriptive API call than the "as short as possible" /a/2/msg/n – MechMK1 Jun 21 '19 at 9:46
  • 2
    Agreed with this observation for URLs that actually need to be read by users. Those that do not have such purpose have no reason not to be on the shortest form possible. – Overmind Jun 21 '19 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.