What is a safe maximum length a segment in a URL path should be?

59
votes

A lot of people are asking "What is the maximum length a URL can be?" but as far as I can see nobody is asking the question:

What is a safe maximum length a segment in a URL path should be?

I think this question is equally as important.

This question is a general question aimed at supporting as many systems out of the box as possible.

In C#, you can get a list of URL path segments from an incoming request, with security modules installed what is considered the maximum length a segment in a URL path can be for this scenario?

I've read on the following page that URL path segments over 260 characters can cause problems in custom ASP.NET modules:

In web browsers, you type URL segments regardless of what website you visit, / is a URL path segment which is usually mapped to a homepage. With Internet Explorer, Chrome and Firefox being popular browsers, what is the maximum length of a URL path segment length they support?

I can see from the following resource that the maximum length of a URL path differs for different browsers and the figure is sometimes quite high:

But this is a path and not a path segment.

I'm also aware that when rewriting paths, the underlying file system path length comes into play, and the ball park figure of what I can see supported is around 255 characters in a *nix OS.

Other considerations include the maximum length of a URL path segment in a database table. For instance, in MySQL a varchar column can contain up to 255 characters, but is there a case for this, are people storing segments of paths in tables in MySQL or are people storing full URL's in varchar columns? Could this mean 255 characters is too long for a URL path segment?

Is there any W3C specification on how long a URL path segment can be as I can't spot anything?

I did read the W3C specification on URI's but again I didn't spot anything of use:

I'm quite baffled that there is no set standard on what a length a URL path segment should be, so maybe I am missing something?

I'm really looking for as much information as possible on what different systems support, and what is considered a safe length for a URL path segment.

3
httpurluri
Possible duplicate of What is the maximum length of a URL in different browsers? – Michael Freidgeim
A segment of a URL is different to a URL. – Professor of programming
Sorry, you are right, I didn't pay enough attention. – Michael Freidgeim

3 Answers

101
votes

Possibly related of What is the maximum length of a URL in different browsers?

In short

According to the HTTP spec, there is no limit to a URL's length. Keep your URLs under 2048 characters; this will ensure the URLs work in all clients & server configurations. Also, search engines like URLs to remain under approximately 2000 characters.

Chrome has a 2MB limit for URLs, IE8 and 9 have a 2084 character limit. So everything points in keeping your URLs limited to approx. 2000 characters.

Also, from a usability point-of-view, URLs that long are not usable/readable by users.

However, the domain name has a max. length of 255 characters. So to be on the safe side, the max. length of an URL segment would be around 1745 characters, given that your URL exists out of 1 segment.

7
votes

There is no such specification limit. There may be implementation limits, but you won't find those in the specifications.

Nit: URIs are defined by the IETF, not the W3C, and the current spec is RFC 3986.

5
votes

The URL length shouldn't exceed 2K (just common practice). The segment path can be any size.

The domain length shouldn't be more than 255 characters (see RFC3986). Limits exist only for implementation. Segments attached to URLs are limited only in particular cases (the old common use).

Nowadays almost all requests go through one file for the rewrite rule, so segment length does not matter. After that, the segment is kept in a variable that can be very large, so there's basically no limit.