What are the components of an HTTP URL and what role do they have in an HTTP Request?

Question

Given this link: http://clk.tradedoubler.com/click?p=113177&a=89693&g=189788889&url=http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

First, the browser submits a request to http://clk.tradedoubler.com/click?p=113177&a=89693&g=189788889

&url= works kind of as a redirect query parameter and redirects refers to another remote URL:

http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

Within this URL, the query parameter ;cpdir= works also as a redirect query parameter and redirects refers to:

http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

All these parameters are appended prepended to the remainder of the query string, whose meaning I do not understand: ?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

What is the difference between &url= and ;cpdir=?

Answer 1

Your analysis is incorrect. It is not a "sort of redirect". As an aside: each horizontal line in this answer indicates a leap in my assumption of your knowledge: I start with the most basic and move to more advanced topics with each successive horizontal line.

Use a software tool such as Burp Proxy or WebScarab. These are ordinarily security testing tools, but you are trying to learn very simple concepts related to URLs and HTTP, and these may help you learn by experience. Set up one of these proxies to intercept URLs in your web browser. The easiest one to use for this purpose is Mozilla Firefox, and you can install a proxy switching addon such as FoxyProxy Standard.

What actually happens when you follow the original link in your post is that your web browser:

• Queries the Domain Name System (DNS) to determine the IP address mapped to clk.tradedoubler.com
• Establishes a TCP socket with the IP address mapped to clk.tradedoubler.com

• Sends an HTTP GET Request that looks something like this:

  GET /click?p=113177&a=89693&g=189788889&url=http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler HTTP/1.1
  Host: clk.tradedoubler.com
  Content-Type: ...
  Content-Length: ...
  Cookie: ...
  User-Agent: ...

where the ... information is replaced with the relevant fields.

---

In order to understand the meaning of this, you must understand what it means to make an HTTP Request. That is exactly what is going on.

The URL is deconstructed so that the entire query string of the URL, except for the http://domain.com part, is sent to the remote server.

Now, what you must realize is that the remote server can do anything it wants with this information. It doesn't have to do ANYTHING with it. It can, among other infinite possibilities:

• Ignore the information
• Send an HTTP request to the URL(s) in the parameters specified in the query string
• Send an HTTP Response to your computer indicating a redirect to one of the URL(s) in the query string
• Store the information in a database
• Call the President of the United States and read the URL using a text reader
• Use the query string inputs as a random number generator to determine which letters to output into cans of Campbell's Alphabet Soup as they roll off the production line
• And so on...

The &url=http://... is just part of the query string which is sent to clk.tradedoubler.com. In order to know what this host is doing with that query string, you would have to see the source code of the software that is processing this information on the clk.tradedoubler.com servers. What you can do from a "black box" perspective is to observe the HTTP Response (if any) that your browser receives from clk.tradedoubler.com after it sends this HTTP Request. To do that, I refer you back to my above suggestion to use Burp or WebScarab.

But you should not assume, in the general case, that the remote server is doing anything in particular with the information being passed to it in a query parameter. What you should be assuming is that it probably does the worst possible thing that it can conceivably do with it -- thinking in this way will help you to at least spot any potential threats it may pose to your personal information.

---

Once you understand these basic concepts, you will be able to start learning about what this URL is actually doing. It is pretty obviously part of a web advertising system. The utm references the Urchin Tracker Module which has been integrated (at least in its API; for the backend, who knows) into the Google AdWords system. So at a bare minimum it is safe to assume that this request is trying to store some information about your web browsing habits in order to serve you relevant advertisements.

---

Regarding this separate question:

What is the difference between &url= and ;cpdir=?

&url= is the start of a query parameter named url whose delimiter is &.

;cpdir= is the start of a query parameter named cpdir whose delimiter is ;. The delimiter used in the embedded URL is ; but is functionally equivalent to &. The reason it is used is that, if & were used, it would confuse the HTTP server parsing the original URL into thinking that everything following the & were starting the name of a new URL parameter of the outer URL.

This is like one of those Matryoshka doll type problems, where you have a URL inside of a URL inside of a URL. You need some way to prevent the HTTP server receiving the "outer" URL from interpreting parameters passed to the inner URLs as parameters belonging to the outer URL. That's why the switch from & to ;. For more information about the formatting and syntax of a query string, see Wikipedia's entry on Query String.