Summary

  • RFC 2397 defined data: for small “immediate” payloads, using an optional media type, an optional ;base64 flag and a comma before the data.
  • By carrying bytes in the URL itself, the scheme moved the decisive control surface from a remote retrieval path to the local URL consumer, media handler and buffer boundary.

Most addresses promise a journey. A client reads a locator, contacts something elsewhere, and receives a representation in return. RFC 2397 described a narrower arrangement: the address could carry the representation with it. Its syntax was compact enough to fit on one line—data:[<mediatype>][;base64],<data>—but the architectural change was larger than the notation.

The RFC called this “immediate addressing.” The word matters. A data: URL does not name a small server hidden behind the comma. For the embedded item itself, there is no second location to consult. The consumer separates the declaration from the payload and then interprets the resulting octets according to the media type. Address and cargo have become one serialized object.

That object still has rules. If the media type is absent, it defaults to text/plain;charset=US-ASCII. A charset may be supplied while the text/plain shorthand remains omitted. The bare token ;base64 selects base64; it is not an ordinary content-type parameter because it has no equals sign. Without it, octets represented by safe URL characters can appear directly, while other octets use %xx escaping. Base64 is a representation choice, not encryption, authentication or permission.

The scheme also refuses a familiar convenience. RFC 2397 defines no relative form. There is nothing for a base URL to complete because the defining act is already present: the string says what kind of data follows and then supplies it. That boundary keeps data: distinct from the relative-reference machinery that made documents movable. One mechanism borrows an address from context; the other carries its own bytes.

The specification repeatedly insists on smallness. It cites the SGML limits that surrounded HTML 2.0 attributes: 1,024 characters for one attribute-value literal, 2,100 for all attribute values in a tag, and 2,100 for the tag itself. Its inline GIF is described as near the edge of usefulness. Those numbers were properties of a surrounding format, not a universal capacity guarantee. They illustrated a more durable point: a syntax may admit a sequence that the host grammar, allocation strategy or implementation cannot sensibly absorb.

That distinction becomes clearer in the security section. A firewall proxy can refuse to retrieve a disallowed media type from elsewhere. It has a harder time policing bytes that arrive already enclosed in a locator handled locally. RFC 2397 therefore places responsibility on the application: it should not interpret a data: value whose declared type its configuration forbids. The relevant gate is the component that turns the bytes into behavior.

The same section warned that the effects of very long values were unknown and that software could behave unreasonably when data exceeded an allocated buffer. The caution joins policy and capacity. A consumer must decide both whether a media type may run and whether the input can be processed safely. A network path that never fetches the embedded item cannot make either decision on the consumer’s behalf.

The document’s history shows that this was not an abstract exercise. The idea dated to August 1995 and had appeared in VRML, embedded-data proposals for HTML, commercial products, and parameters for Java and ActiveX objects. The syntax was refined along the way: media type elision became possible, the base64 indicator became tighter, and quoted-printable was removed because URL escaping already supplied the necessary representation.

Later errata are part of the record, but not all have equal standing. Two verified corrections replace an impossible %fg example and change the imported RFC 2396 production from the undefined urlchar to uric. A reported proposal and a held-for-update report expose ambiguity around quoted media-type parameters and delimiters; they are warnings about the edge, not verified replacement text. A proposal to rename every “URL” as “URI” was rejected because the original terminology was historically correct.

RFC 2397’s lasting lesson is therefore about control, not novelty. When an address contains the thing it names, control does not disappear. It relocates. The parser chooses where metadata ends. The decoder reconstructs the octets. The media handler decides what they mean. The application decides what it will permit. The buffer decides what it can survive. The shortest retrieval path may also be the path on which local discipline matters most.

Sources