Definition of the URL MIME External-Body Access-Type
Extracted elements (15)
Registering a single 'URL' access-type rather than individual access-types per URL scheme provides message/external-body access to all current and future URL-based retrieval mechanisms, avoiding the need to register a new MIME access-type for each new URL scheme.
URL strings are transformed into the URL-parameter encoding (splitting into 40-character tokens) because URL strings can be of arbitrary length and contain arbitrary content, creating problems when embedded in MIME headers that must be line-wrapped per RFC 822 rules.
Extraction of the URL string from a URL-parameter is performed by removing the enclosing quotes and any linear whitespace; the remaining string is the URL. This reverses the encoding transformation.
Some URLs (e.g., HTTP with content negotiation) can return objects in multiple formats. Applications may have already made irrevocable decisions based on the declared content-type in the inner message/external-body header, so retrieved objects whose content-type does not match must not be used.
After encoding special characters, the URL string must be broken into substrings of 40 characters or less, each placed as a URL-word in the URL-parameter, separated by one or more spaces.
All occurrences of SPACE, CTLs, double quotes, backslashes, and 8-bit characters in the URL string must be encoded using the URL percent-encoding scheme specified in RFC 1738 before embedding the URL in a URL-parameter.
The enclosing quotes in a URL-parameter are always required because all URLs contain one or more colons, and colons are tspecial characters per RFC 1521.
The phantom body area of a message/external-body part using the URL access-type is not used and should be left blank.
The URL access-type is only intended for use with URLs that actually retrieve something. Non-retrieval URL mechanisms such as 'mailto' may not be used with this access-type.
When URLs are used as a message/external-body access-type, only those versions of the object whose content-type agrees with that specified by the inner message/external-body header can be retrieved and used.
Defines a new MIME message/external-body access-type named 'URL'. The access-type uses a mandatory 'URL' content-type parameter to store the URL string; the phantom body area is not used and should be left blank.
The URL parameter is a quoted string consisting of URL-words (tokens not exceeding 40 characters each) separated by linear whitespace, allowing long URL strings to be embedded in MIME headers that must be line-wrapped per RFC 822 rules.
The Content-MD5 field can be used with any message/external-body access-type, including URL, to provide an integrity check ensuring the referenced object matches what the message originator intended. This is not a signature service.
The security considerations of using URLs in a MIME access-type context are no different from those in other URL usage contexts; the specific security considerations for each URL scheme are discussed in the scheme's defining document.
URL-parameter is defined as: URL-parameter := '"' URL-word *(*LWSP-char URL-word) '"'; URL-word := token, must not exceed 40 characters in length. This encodes an arbitrary-length URL string for use in a Content-Type header.