matrix-org / matrix.to

A simple stateless privacy-protecting URL redirecting service for Matrix
http://matrix.to
Apache License 2.0
963 stars 207 forks source link

Switch to valid URL syntax #17

Open ara4n opened 7 years ago

ara4n commented 7 years ago

Technically you're meant to escape # and @ symbols within URL paths/fragments. The fact we don't causes woes like those described on https://meta.discourse.org/t/broken-links-blank-page-with-appearing-in-url/52640/10

ara4n commented 7 years ago

The solution to this is probably to switch over to compact URLs everywhere as per issue #10.

uhoreg commented 7 years ago

The problem with the compact URLs is that a URL like https://matrix.to/@matthew:matrix.org would 1) send the entire URL to the server, which may be a privacy concern, and 2) require some server-side help, which would make it harder for people to host it themselves (e.g. matrix.to currently 404s on that link instead of loading the main matrix.to page)

StefanBrand commented 7 years ago

Usually one would handle it like this, I guess:

https://matrix.to?r=#matrix:matrix.org

https://matrix.to?u=@matthew:matrix.org

ara4n commented 7 years ago

yeah, but i'd prefer it to look more cosmetically like a mx://server/resource URL rather than a slightly clunky querystring, and to preserve the correct sigil semantics of matrix user ids, room aliases etc (even though they don't fit very nicely into http urls sadly)

phaux commented 6 years ago

How about /u/username/server.name for users and /r/roomname/server.name for rooms?

t3chguy commented 6 years ago

@phaux what about roomId ! vs roomAlias # and also event permalinks !/$

eMPee584 commented 4 years ago

🥁

skepticalwaves commented 2 years ago

Another big problem with the "#" syntax is that this makes the matrix.to implementation impossible to proxy with apache/nginx as the full URL doesn't get sent as part of the "GET".

https://stackoverflow.com/questions/9484852/hash-character-in-urls-accessing-and-redirecting-in-apache

t3chguy commented 2 years ago

as the full URL doesn't get sent as part of the "GET".

This is by design. To prevent the host being able to sniff on usage.