Home/ Questions/Q 6385229
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T02:52:24+00:00

I am still fairly new to web application development, so perhaps this is a

  • 0

I am still fairly new to web application development, so perhaps this is a n00b question.

It seems like most websites will just silently ignore query string arguments they do not need nor understand. For example, a github URI usually looks like:

https://github.com/airbnb

Now if I just tack on a bogus query string, as in:

https://github.com/airbnb?foo=bar

The page loads just fine and doesn’t complain about the query string.

This seems like a perfectly reasonable behavior, and I spot-tested some other sites and they also ignored extraneous and/or unneeded query string arguments.

My questions are:

1) Is this the correct or de facto behavior of most web applications? (presumably answer is yes)

2) If (1) is yes, is the reason just common sense, convention, simplicity, etc? Or do standards like HTTP or REST have any guidance or interest in deciding how this is handled?

Alternatives would be to:

  • Explicitly guard against unknown query string arguments, which is perhaps a bit heavy-handed
  • Redirect to a “clean” version of the URL w/o the bogus strings. Again, perhaps this is unnecessary
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The practice I have always followed while developing web applications is performing only the validation of expected parameters. You should not, IMHO, even read/parse any parameter which you do not expect, because the possibilities are practically infinite. Imagine that it is possible to perform a query like:
    https://github.com/airbnb?foo=bar
    and also:
    https://github.com/airbnb?fooo=bar
    and also:
    https://github.com/airbnb?foooo=bar

    So, if one is to refuse every single parameter not accepted, it would certainly be a little overwhelming. Just ignoring and not even reading them should be safe enough.

    Refusing requests containing unexpected parameters will also bring additional challenges, for example: Google Analytics (and other tracking solutions as well) might reach your site using additional parameters.

    Side note: if your app supports redirection, I recommend reading the following tip, just in case: http://guides.rubyonrails.org/security.html#redirection

    • 0