Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Given this link: http://clk.tradedoubler.com/click?p=113177&a=89693&g=189788889&url=http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

First, the browser submits a request to http://clk.tradedoubler.com/click?p=113177&a=89693&g=189788889

&url= works kind of as a redirect query parameter and redirects refers to another remote URL:

http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

Within this URL, the query parameter ;cpdir= works also as a redirect query parameter and redirects refers to:

http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

All these parameters are appended prepended to the remainder of the query string, whose meaning I do not understand: ?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler

What is the difference between &url= and ;cpdir=?

share|improve this question
1  
In addition to my answer, none of the content of a URL is ever translated into a "header" of any kind. The headers in a standard GET request for most web browsers are determined by your session state and browser settings (such as your user agent, etc). The URL itself should only ever impact the Host: header; I can't imagine it would have any effect on the rest of the headers. –  allquixotic Jan 15 '13 at 20:04

1 Answer 1

up vote 6 down vote accepted

Your analysis is incorrect. It is not a "sort of redirect". As an aside: each horizontal line in this answer indicates a leap in my assumption of your knowledge: I start with the most basic and move to more advanced topics with each successive horizontal line.

Use a software tool such as Burp Proxy or WebScarab. These are ordinarily security testing tools, but you are trying to learn very simple concepts related to URLs and HTTP, and these may help you learn by experience. Set up one of these proxies to intercept URLs in your web browser. The easiest one to use for this purpose is Mozilla Firefox, and you can install a proxy switching addon such as FoxyProxy Standard.

What actually happens when you follow the original link in your post is that your web browser:

  • Queries the Domain Name System (DNS) to determine the IP address mapped to clk.tradedoubler.com
  • Establishes a TCP socket with the IP address mapped to clk.tradedoubler.com
  • Sends an HTTP GET Request that looks something like this:

    GET /click?p=113177&a=89693&g=189788889&url=http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler HTTP/1.1
    Host: clk.tradedoubler.com
    Content-Type: ...
    Content-Length: ...
    Cookie: ...
    User-Agent: ...

where the ... information is replaced with the relevant fields.


In order to understand the meaning of this, you must understand what it means to make an HTTP Request. That is exactly what is going on.

The URL is deconstructed so that the entire query string of the URL, except for the http://domain.com part, is sent to the remote server.

Now, what you must realize is that the remote server can do anything it wants with this information. It doesn't have to do ANYTHING with it. It can, among other infinite possibilities:

  • Ignore the information
  • Send an HTTP request to the URL(s) in the parameters specified in the query string
  • Send an HTTP Response to your computer indicating a redirect to one of the URL(s) in the query string
  • Store the information in a database
  • Call the President of the United States and read the URL using a text reader
  • Use the query string inputs as a random number generator to determine which letters to output into cans of Campbell's Alphabet Soup as they roll off the production line
  • And so on...

The &url=http://... is just part of the query string which is sent to clk.tradedoubler.com. In order to know what this host is doing with that query string, you would have to see the source code of the software that is processing this information on the clk.tradedoubler.com servers. What you can do from a "black box" perspective is to observe the HTTP Response (if any) that your browser receives from clk.tradedoubler.com after it sends this HTTP Request. To do that, I refer you back to my above suggestion to use Burp or WebScarab.

But you should not assume, in the general case, that the remote server is doing anything in particular with the information being passed to it in a query parameter. What you should be assuming is that it probably does the worst possible thing that it can conceivably do with it -- thinking in this way will help you to at least spot any potential threats it may pose to your personal information.


Once you understand these basic concepts, you will be able to start learning about what this URL is actually doing. It is pretty obviously part of a web advertising system. The utm references the Urchin Tracker Module which has been integrated (at least in its API; for the backend, who knows) into the Google AdWords system. So at a bare minimum it is safe to assume that this request is trying to store some information about your web browsing habits in order to serve you relevant advertisements.


Regarding this separate question:

What is the difference between &url= and ;cpdir=?

&url= is the start of a query parameter named url whose delimiter is &.

;cpdir= is the start of a query parameter named cpdir whose delimiter is ;. The delimiter used in the embedded URL is ; but is functionally equivalent to &. The reason it is used is that, if & were used, it would confuse the HTTP server parsing the original URL into thinking that everything following the & were starting the name of a new URL parameter of the outer URL.

This is like one of those Matryoshka doll type problems, where you have a URL inside of a URL inside of a URL. You need some way to prevent the HTTP server receiving the "outer" URL from interpreting parameters passed to the inner URLs as parameters belonging to the outer URL. That's why the switch from & to ;. For more information about the formatting and syntax of a query string, see Wikipedia's entry on Query String.

share|improve this answer
    
Can you clarify one last thing. I can see that the whole long link lands to this link tele2.se/mobilt-bredband.html But I can see that all the ?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler is appended to end of the ;cpdir=tele2.se/mobilt-bredband.html. So, my question is will the browser will be able to pass the utm appends to clk.tradedoubler.com and when will land to htp://www.tele2.se/mobilt-bredband.html? Or it will first land to htp://www.tele2.se/mobilt-bredband.html and the appends will be never sent to tradedoubler? –  user385917 Jan 15 '13 at 20:13
    
The URL itself is only making one HTTP Request to one server: clk.tradedoubler.com. The rest of the behavior is application-dependent and you will have to use an intercepting proxy to get an idea of what redirects, if any, may exist. If you don't understand this comment, re-read my answer. –  allquixotic Jan 15 '13 at 20:18
    
So, as far as I understood everything will be passed to clk.tradedoubler.com. This will catch whatever it needs from the link and the user will be redirected to the landing page - tele2.se/mobilt-bredband.html. Thanks, for your profound answer! –  user385917 Jan 15 '13 at 20:23
    
If the user is redirected to the "landing page", the only reason that the redirect happens is that the server clk.tradedoubler.com decides that that's what it wants to do. This behavior has absolutely nothing to do with the URL or HTTP specification. I'm not about to try the link myself, so I may as well assume that it will do something nasty. The redirect is merely an implementation detail. –  allquixotic Jan 15 '13 at 20:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.