So You Want to Define a Well-Known URI

mnot.net141 pointsby ingve97 comments

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Hacker News
The consideration about having more than one of them on a domain seems like something that's often overlooked.
by inigyou
.well-known started tidy and quietly became the junk drawer of the web root. security.txt, ACME, app-site-association, and counting.
by momoraul
Isn't that the point though? Keeping all the junk in a drawer labeled as junk, instead of keeping it on the kitchen counter?
by inigyou
A junk drawer is an improvement over scattered junk.
by delichon
What do you mean? It was explicitly designed to be a junk drawer.
by marcosdumay
I wish we had one for navigation layout of a site so browser chrome could render that in a consistent way. It would also be a boon for a11y.
by user3939382
Title says uri but post only about urls, a type of uri
by jiggunjer
Does a change-password registry actually get used, even by bots? I don't see bots checking for a .well-known/change-password url on my sites. It seems a good place to put public configs, just to have a place for them, but not as a means of discovery.
by welder
Some password managers, such as Chrome's, offer a "change password" button in the UI that informs the user if their password has been compromised. This is based on .well-known/change-password.
by ameliaquining
One disappointment you can't help but feel, having worked in technology a while, is about how people solve the same problems over and over in redundant and subtly incompatible ways.
How do you associate metadata with a public name? A SRV record! No, a TXT record! No, a meta tag! No, data attributes! No, an X.509 attribute! No, a random file at top level! No, a well known file under some schema! No, ...
It goes on forever. We're left with a mishmash of mechanisms and lowest common denominator support for them all.
It would be nice if we picked an extension mechanism and maximally enhanced it rather than having everyone invent his own
by quotemstr
"This Web site requires a more modern browser to operate securely; please upgrade your browser."
Alternative, no SNI required
https://web.archive.org/web/20260619061625if_/https://mnot.n...
by 1vuio0pswjnm7
If one is conducting surveillance and/or censorship of www users, SNI is not good
It's great
by 1vuio0pswjnm7
Internet Draft: ECH Considered Harmful
https://www.ietf.org/archive/id/draft-stein-tls-ech-consider...
by 1vuio0pswjnm7
SNI is good, though? I'm curious how you are running into this.
by xyzzy_plugh
How well-known are those URIs though? :-\
by einpoklum
Slightly less well-known than XDG directories among the developers of Linux-targeted software, it would seem.
Seriously, what an oxymoronic name. "/index.html" is a well known URL, literally: most of web-developers are aware of it. But inventing a bunch of URLs with predefined semantics and then slapping the "well-known" label on it... well, it won't magically make them actually well-known.
by Joker_vD
I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.
by timwis
There's an interesting list on Wikipedia: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...
by reddalo
They are collected at this registry: https://www.iana.org/assignments/well-known-uris/well-known-...
by ano-ther
I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one.
I did read one before while working with github oidc, and I did find it very useful.
What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? This far from the first case I've ran into either.
by eschatology
I do think it is important to have autonomous discoverability with domain-anchored trust, whether through .well-known or DNS records or DNS over HTTP. It looks like cloudflare has already added a bunch of observability into their products around this area, and I am investigating too [1]. It seems like the number of services needing these, and the amount needed per org should both go up with more agentic use cases.
I believe auth.md is also a recent example that uses .well-known
[1] https://instagrate-me.sudoscience.dev/
by devdoshi
Why are they so specific?
Why password-reset instead of a more generic link tree?
Why discord domain verification instead of domain-verifications with a dynamic list on entries?
Seems like a waste of time. I would just define my own spec outside of well known for my use case.
by jvuygbbkuurx
> discord domain verification
That’s on Discord. They’re not in the registry: https://www.iana.org/assignments/well-known-uris/well-known-...
> Why password-reset instead of a more generic link tree?
[edit: answered in more detail in a sibling thread https://news.ycombinator.com/item?id=48596286]
by notpushkin

> Why discord domain verification instead of domain-verifications with a dynamic list on entries?

The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else.

Example:

    ;; ANSWER SECTION:
    ycombinator.com.        300     IN      TXT     "openai-domain-verification=dv-QbhxxK0G0JK0dnyZ4YTsNAfw"
    ycombinator.com.        300     IN      TXT     "v=spf1 include:_spf.google.com include:mailgun.org a:rsweb1-36.investorflow.com include:_spf.createsend.com include:servers.mcsv.net -all"
    ycombinator.com.        300     IN      TXT     "MS=ms37374900"
    ycombinator.com.        300     IN      TXT     "anthropic-domain-verification-0qe2ww=yK576oHdDgyTcXgkPfj1KXgGt"
    ycombinator.com.        300     IN      TXT     "ZOOM_verify_2ndw8KZxSRa8PT8NmdyXvw"
    ycombinator.com.        300     IN      TXT     "google-site-verification=KsI69Y_jEVkp4eXqSQ9R9gwxjIpZznvuvrus6UolB9Y"
    ycombinator.com.        300     IN      TXT     "ca3-4861b957e83847c188e45d04ec314ee3"
    ycombinator.com.        300     IN      TXT     "apple-domain-verification=WG0sP5Alm7N6h1Te"
    ycombinator.com.        300     IN      TXT     "dropbox-domain-verification=asc63coma4mv"
    ycombinator.com.        300     IN      TXT     "google-site-verification=GJKdQskycEclAGPua3yXB9m_nVhxbrsVps_y-t9SXV0"
    ycombinator.com.        300     IN      TXT     "Wayback verify for support request 741082"
    ycombinator.com.        300     IN      TXT     "google-site-verification=rivq8jKu6AADGtbbEzJhmOpcqq08B7QxIzXxYV8DtyU"
    ycombinator.com.        300     IN      TXT     "rippling-domain-verification=a660f7a4ab77a3de"

by arcfour

Your own spec wouldn't be used by anyone else.
The password-reset well-known endpoint is used by password managers to show a "Change password..." button in their interface, which magically links to the password change page described in that well-known file.
by reddalo
No, in fact I don't. But this post wouldn't be of any help anyway. It feels like it's about nothing, there is no substance, just stating some obvious facts. Without examples that lead to some real recommendations, this whole expertise claimed by the author is of no use.
by sandblast
The point of the post was that you need to add robots.txt (or similar) because it's a thing, and also tell us where they are.
by wseqyrku
That's harsh. I believe the author really does get questions from people who want to register a well known path, and probably some of them really failed to consider sites with ~user paths or whathaveyou and this post might push them to use a better solution.
And if you read that and still feel confident that you want a well known url, he links you to the registration process.
by thefifthsetpin
> expertise claimed by the author
The author is on record as trying to remove HTTP 418 "I'm a teapot" support from NodeJS, which resulted in backlash and Python adding support for it.
https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_...
by amiga386
I wish people would follow this, instead of coming up with new standards in the root namespace. "llms.txt" [1] comes to mind, for example.
Let's stop polluting the root of a domain!
[1] https://llmstxt.org/
by reddalo