Search code examples
urlat-sign

URL with at-sign is truncated

Is anyone familiar with URL format like below?

https://[email protected]

https://www.facebook.com:@www.cigital.com

As you can see from visiting these URLs, you will be navigated to https://www.cigital.com/ instead of https://www.facebook.com.

Can someone shed some light on the URL format and why the www.facebook.com part is truncated?

Solution

  • It's an HTTP authentication scheme to send an authorization header along with a request.

    https://<username>:<password>@domain.com

    If no authentication required, it is usually effectively the same as an ordinary GET request to https://domain.com.

    A URL like https://[email protected]/ looks like phishing to me; it was made to intentionally deceive someone into believing the destination was somewhere at facebook.com but actually led to someplace else.