Requesttarget

Request-target, often written as request-target in RFCs, is the component of an HTTP request line that identifies the resource the client wishes to access. In HTTP/1.1, a request line has the form: method, request-target, HTTP-version. The request-target conveys which resource should be retrieved or acted upon and is interpreted by the server to map the request to a resource.

Forms of the request-target

- Origin-form: the common form for direct client requests, such as GET /path/to/resource?query HTTP/1.1, where the target is the path and query relative to the server’s URI space (the leading slash indicates the root of the server).

- Absolute-form: the full URL, such as GET http://www.example.org/resource HTTP/1.1, where the target includes the scheme, host, and path.

- Authority-form: used by proxies for tunnel establishment, e.g., CONNECT www.example.com:443 HTTP/1.1; the target specifies the authority to connect to.

- Asterisk-form: used with OPTIONS, e.g., OPTIONS * HTTP/1.1, where the target does not point to a specific resource.

HTTP/2 and HTTP/3

In HTTP/2 and HTTP/3, the request-target is carried in protocol-specific headers (for example, the :path pseudo-header in HTTP/2). The underlying semantics remain the same: the client indicates the resource desired, and the server maps it to a resource or action.

Usage and considerations

Servers parse the request-target to locate resources, apply routing, and enforce security policies. Proxies and gateways may alter or reinterpret the target, which can introduce risks such as request smuggling if not properly handled. Request-targets may contain percent-encoded characters and must be validated and normalized by the server.

See also: RFC 7230, HTTP semantics, HTTP/2 and HTTP/3 mappings.