A URL with an
@ in the path is valid. RFC 2396 talks about
@ in section 2.2. It is a "reserved character". That means that it is allowed in the URL, but that it might have special meaning depending on the spec for that particular URL. In the case of HTTP URLs, there is no special meaning for
@ in the path portion. Therefore, it is a legitimate character that may be used by webmasters.
Any software which attempts to use heuristics to identify URLs and autolink them should allow an
@ in the path of a HTTP URL.
There are some possible security implications from allowing the path of a linked URL to contain
@ does have special meaning in the domain name portion of a HTTP URL. There it specifies the user name and password for basic authentication. Auto linking a URL like
http://user:[email protected]/ could cause users that click it to automatically log into another site with the specified user and password.
- Auto linking a URL like
[email protected] could be problematic. Is that an email address? Is that an attempt to get somebody to log into
foo.example.net as the user
In my opinion, these security concerns are minor and would be mitigated by ensuring that any implementation restricts the allowed
@ to the portion after the domain name and slash. StackExchange sites do autolink URLs with
@ in the path. So doing so is not without precedent.