The "hxxp" and "hxxps" URI Schemes

This document describes the "hxxp" and "hxxps" URI schemes, which are widely used by the security community to obfuscate an http or https URI to avoid being accidentaly interpreted and loaded by a web browser or user-agent. These schemes are used in case the resource is dangerous and there is security risks on being automatically processed by an application, such a pre-loading mechanism in web user agents. It also prevents the creation of "clickables" areas in user interfaces, which could detect http or https URIs automatically. The purpose of this registration is to document its use, prevent any registration of this scheme in the future, explicitly recommend to web application developers to never act with this URI schemes in any way, and provide a safe method for the security community to share malicious information. These schemes must not be treated as an http or https schemes, and must not be identified as web resources. Its consumption is only for humans and documentation, and should be handled with caution by security professionals.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

The "hxxp" URI syntactically conforms to the <hxxp-uri> rule below, expressed using the Augmented Backus-Naur Form (ABNF): query = fragment = ]]>

The "hxxps" URI syntactically conforms to the <hxxps-uri> rule below, expressed using the Augmented Backus-Naur Form (ABNF): query = fragment = ]]>

The resource that is referenced by a particular "hxxp" or "hxxps" URI is NOT meant to be interpreted or parsed in any way for applications, or any automated means. The resource MUST be interpreted and consumed by human security professionals.

"hxxp" and "hxxps" URIs are subject to encoding rules as defined in RFC 3986.

The author acknowledges the suggestions and comments made by Fernando Gont and Harlan Lieberman-Berg, for the first revision.

The IANA is requested to register "hxxp" and "hxxps" URI schemes in the "Provisional URI Schemes" registry. The information below is provided according to the guidelines from RFC 7595: ----- Scheme name: hxxp Status: Provisional Applications/protocols that use this scheme name: "hxxp" URIs are forbidden to be used by applications. Contact: Hugo Salgado <hsalgado@nic.cl> Change controller: Hugo Salgado <hsalgado@nic.cl> References: "The "hxxp" and "hxxps" URI Schemes" Internet Draft, https://datatracker.ietf.org/doc/draft-salgado-hxxp/ ----- ----- Scheme name: hxxps Status: Provisional Applications/protocols that use this scheme name: "hxxps" URIs are forbidden to be used by applications. Contact: Hugo Salgado <hsalgado@nic.cl> Change controller: Hugo Salgado <hsalgado@nic.cl> References: "The "hxxp" and "hxxps" URI Schemes" Internet Draft, https://datatracker.ietf.org/doc/draft-salgado-hxxp/ -----

As stated in the Introduction, the "hxxp" and "hxxps" schemes are forbidden to be used or interpreted by applications. These schemes must be consumed only by humans. Application developers are encouraged to forbid "hxxp" and "hxxps" schemes URIs inside HTML anchors or tags.