An HTML page is hypertext because it contains hypertext links, which we will simply call links. When we click on a link, we retrieve information from a different page, either on the same web server or on a different server. We use the <a> tag in HTML to construct a link. FIGURE 15.3 illustrates a simple link. Every link has two parts:

1. Highlighted text: When we click our mouse on the highlighted text, the web browser follows the link.

2. Target: When the browser follows a link, it retrieves the web page indicated by the link’s target.

The starting tag in Figure 15.3 contains the link’s target: It is the value of the “href” argument. A tag may carry one or more arguments, each one containing the argument’s name, an “=” sign, and the argument’s value.

In this case, the link’s target is another HTML file named “about.html” stored on the same web server. If a file’s link refers to a different web server, then we use a web address, as will be described in Section 15.1.1.

The starting tag and end tag enclose the highlighted text. The end tag never contains arguments, even if they appear in the starting tag.

Most browsers rely on a mouse-based GUI to handle links. If we move our mouse over a link and click on it, the browser follows the link. If we just place the mouse over the link without clicking, we remain on the current page. Most browsers also provide a discreet status display at the bottom of the browser’s window.

When we place the mouse over a link without clicking, most browsers display the target’s file name or web address in the status display. This allows us to identify the link’s destination before we decide to click on it.

Originally, authors of web pages relied on HTML tags to control both the style and the structure of web pages. Today, most sites use Cascading Style Sheets, or CSS files, to control the page’s appearance. These files use a distinctive “.css” suffix. Web pages still use the HTML tags to describe the structure and flow of information on the page. The CSS files specify header formatting, typeface selection, bullet formats, and so on.

CSS files provide an easier way to manage web page formats across multiple pages on larger sites. They also provide more effective control over page formatting; for example, CSS allows more precise specification of typefaces and sizes. Even though most browsers still recognize the older HTML formatting tags, most websites avoid using them, because CSS-based formatting is more powerful and easier to manage.

When a tag in a web page provides a link or an image, it often refers to a different file. For images, the browser uses HTTP to retrieve the image and then displays it on the page. An HTML file also may retrieve some of its HTML text from another HTML file.

Most important, an HTML file may retrieve its content either from its own server or from any other web server on the internet. Any HTML tag that accepts a file name will also accept a reference to another page or file elsewhere on the web.

For example, some websites display advertising that is provided by a separate advertising service. The service tailors the advertising to the specific user who visits the site, as well as to the site itself. The website contents come from the server being visited, but the tailored ads come from the servers for the advertising service.

Although weblinks usually lead to documents or images, some links activate particular applications. An email URL, for example, contains an email address. When we follow an email URL, the browser automatically starts an email client and passes it the email address in the URL. Web pages often provide a “Contact Us” link that contains an email URL.

FIGURE 15.5 describes the format of an email URL, which follows the format of a URI. To the left of the colon is “mailto,” the scheme’s name. To the right is an email address. The @ sign separates the user ID from the email server’s domain name.

Returning to the more common URL format in Figure 15.4, the authority part of the URL identifies the server containing the resource we want. In most cases, the authority simply contains the domain name of the server. The authority field may contain additional fields as shown in FIGURE 15.6. Email URLs are the only ones that routinely use the @ sign or anything to the left of it. The port number (shown on the right following a colon) appears occasionally.

The URL’s scheme usually identifies the network service being used with the resource. We identified specific TCP or UDP port numbers associated with well-known services. (See Section 11.3.) When a URL specifies “http,” the client retrieves the resource by opening a connection to port 80 on the server. Some resources may be available through nonstandard port numbers. For example, a web server might provide one set of pages through port 80 and a different set through port 8080. If the URL doesn’t use the default port, it must include the correct port number in its authority field. Figure 15.6 shows the correct format in which the nonstandard port number follows the domain name.

The user ID and password information are very, very rarely used when retrieving web documents. It is obviously a security risk to embed a reusable password in a URL, because we’ll disclose the password whenever we share that URL. Moreover, URLs often travel in plaintext across the internet. Some browsers, like Firefox, display a warning if a user includes that information in a URL.

Many browsers also allow us to enter a numeric IP address instead of a domain name. For example, many commercial gateways provide web-based administration if we direct the browser to the gateway’s IP address. To reach such a web server, we type its IP address in brackets, for example: [192.168.1.1].

The authority field ends with a slash and is followed by the file’s path name. Different file systems use different path name delimiters (Table 3.1). Most web servers, however, expect to see the slash “/” character as the path name delimiter, even if the server runs atop Windows or MacOS. The server software interprets the path name and translates it as necessary before passing it to the file system.

Most file systems treat path and file names as being case sensitive. However, not all websites have case-sensitive paths. Many internet identifiers—notably domain names—ignore case when interpreting the text. Some web servers apply this to URLs. To do so, the server adjusts the path name before passing it to the file system.

When we type in a web page location, we want to type as little as possible. We often omit the “http://” suffix to the URL, and most browsers fill it in for us. People often type nothing more than the website’s domain name into the browser, and the browser locates its home page.

When we ask a web server for a page and we don’t actually provide a page name, the server tries to guess the page’s name. Typical guesses include:

• ■   index.htm, index.html

• ■   home.htm, home.html

• ■   default.htm

For example, if we type “http://www.amawig.com” into a web browser, the server will eventually retrieve the home page “index.html” because that file is stored in the site’s home directory.

Most server software may be configured to look for additional default file names. In dynamic servers, the default names may select scripts to execute (see Section 15.3).

When the HTML file refers to other files, the browser must retrieve the contents in order to display the entire page. To retrieve the other files, the browser opens HTTP connections to the appropriate servers and requests the required files.

Originally, each file transfer required a separate connection. As web server traffic grew, however, sites wanted higher efficiency. When a typical web page refers to another file, the file often resides on the same server. The client wastes time and trouble to close one connection when it is immediately going to reopen it to transfer another file. The latest HTTP systems may transfer multiple files through a single connection.

Search engines, on the other hand, collect information about web content automatically. They use special software that systematically “crawls” the web, following the links it finds in web pages. This software typically is called a web crawler, or a spider, or even a robot. An individual site may control how search engines handle its site by installing a special file called “ROBOTS.TXT.” If the file is present, a well-behaved crawler examines its contents for instructions before crawling the site.

Search engines pose interesting security problems. If a site posts sensitive information by accident and a page links to it, then anyone can find the information using the search engine. Moreover, a clever search can locate sensitive or malicious information anywhere on the internet.

For example, sensitive personal information occasionally appears, including such details as credit card numbers. Card numbers follow a simple format, and they fall into particular numeric ranges depending on the issuing organization. In the past, search engines have allowed searches on those ranges. Such searches might locate pages that were made visible accidentally by an e-commerce site. In other cases, such pages contained information collected by a fraudster.

Although traditional search engines like Google and Bing locate and index documents and other digital media on the internet, search engines like “Shodan” locate other computing resources, like IoT devices, routers, SCADA systems, and even traffic light controls. Shodan is particularly well known for indexing household and private security webcams. If a webcam’s owner fails to password-protect the webcam or to choose a hard-to-guess password, then Shodan users can watch the video feed and may be able to control the camera remotely.