Designing URLs and applying percent-encoding rules

Goal

URLs that stay valid for years, compare equal when they mean the same resource, and pass through logs, other systems' encoders and copy-paste without double encoding or accidental structure.

Prerequisites

RFC 3986: a URI has scheme, authority, path, query and fragment; reserved characters are the gen-delims :/?#[]@ and sub-delims !$&'()*+,;=; unreserved are letters, digits, -, ., _ and ~. The WHATWG URL Standard is what browsers and many libraries implement; it defines per-component percent-encode sets and the application/x-www-form-urlencoded format used by HTML forms.

Steps

1. Choose structure: nouns for collections and items (/orders/123), lowercase words joined by hyphens, one rule for trailing slashes, no file extensions unless they select a format, and never session ids or tokens in a URL, since URLs land in logs and Referer headers.
2. Put identity and hierarchy in the path and filtering, paging and options in the query; make query parameters order-independent with documented defaults.
3. Build URLs component-wise with a library: encode each path segment and each query key and value separately, then join. Never run an encoder over a finished URL.
4. Encode the UTF-8 octets of a value. In a path segment encode /, ?, #, % and non-ASCII; in a query value also &, = and +. Leave unreserved characters alone and use uppercase hex digits, as RFC 3986 asks of producers.
5. Treat + deliberately: in form-encoded query strings space becomes + and a literal plus becomes %2B; in paths + is just a character. Use a form decoder for the query and a plain percent decoder for the path, on both client and server.
6. Decode once, after splitting into components, at the boundary of your system. RFC 3986 states that implementations must not percent-encode or decode the same string more than once; decoding early turns %2F into a path separator.
7. Normalise for comparison: lowercase scheme and host, uppercase percent-encoded hex, decode percent-encoded unreserved characters, remove dot segments and the default port. Do not lowercase the path unless your server treats paths case-insensitively.
8. Publish one canonical form and redirect variants (case, trailing slash, index.html) to it with a permanent redirect.
9. Test by round-tripping hostile values (space, /, ?, %, +, ä, an emoji, ..) through each client encoder and the server decoder and comparing the recovered segments.

Expected result

One canonical URL per resource; encoders in different languages produce byte-identical URLs for the same components; decoding never turns data into structure.

Limits and test basis

RFC 3986 and the WHATWG parser differ in details (the latter is more permissive with input), so library behaviour has to be checked, not assumed. Drawn from the cited specifications; no measurements are claimed.