HTTP Link header

Supporting documents: Web Linking

Required by Web Linking. Bad: a `Link` value breaks the RFC 8288 grammar (target not in <angle brackets>, a parameter with a bad name or no value, or an unterminated quote), so a strict parser may drop it. A dangling `;` is not flagged: the RFC's own parsing algorithm reads past it. Fix: emit each link as <https://example.com/target>; rel="alternate", with parameter values quoted.

Supporting documents: Web Linking

Required by Web Linking. Bad: a `Link` value declares no relation (the rel parameter is absent or empty, and RFC 8288 requires it), so agents can't tell what the link is for and ignore it. Fix: add a rel naming the relationship, e.g. rel="canonical".

Supporting documents: Web Linking

Required by Web Linking. Bad: a `Link` value's target (or anchor) isn't a valid URI-Reference, so the reference points nowhere. Fix: emit a syntactically valid URI (relative and cross-scheme targets are fine; stray spaces and unescaped characters are not).

Supporting documents: Web Linking

Client guidance in Web Linking. Bad: a Link header uses anchor= to make a claim about a resource on another host, and RFC 8288 suggests applications may discard such third-party assertions, so agents may ignore it. Fix: drop the anchor, or publish the link from the host it describes.

Supporting documents: Web Linking

Lumar readiness bar: no specification requires this. Provisional security check; precision has not yet been measured. Bad: this https response's Link header points an agent at a plain http:// target, so following it downgrades to content that can be altered in transit. A Lumar bar: RFC 8288 allows it. Name-only relations (type, profile, license) are not judged. Fix: link the https URL.

An advertised HTTP destination permits unencrypted communication.

Only advertised transport configuration is observed; API deployment security is not fully assessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: Web Linking

Required by Web Linking. Bad: a `Link` value repeats the rel parameter, which RFC 8288 forbids, so parsers ignore all but the first and the intent is ambiguous. Fix: keep a single rel per value (multiple relation types go inside one rel: rel="alternate canonical").

Supporting documents: Web Linking

Required by Web Linking. Bad: a `Link` value's rel isn't valid relation-type(s): each space-separated type must be a registered token or an absolute-URI extension relation. Fix: use a registered IANA relation name (canonical, alternate, ...) or a full URI for a custom relation.