The toy query example keeps its boundary narrow.
What this toy model checks
The trust boundary parses one GET request, splits path from query, parses two ASCII pairs, and confirms there is no body.
recompute query rows \text{recompute query rows} recompute query rows Query honesty boundary The query bytes, parsed pairs, and empty body check are recomputed from pinned GET bytes. Query honesty boundary - GET /search query q=cat and page=2, body 0 bytes section name value check request line method GET parsed request line target display path /search question q=cat ampersand page=2 safe display form request line version HTTP/1.1 parsed header Host search.example exact target path /search before question mark query display words q=cat ampersand page=2 safe display form query exact hex 713d63617426706167653d32 pinned bytes pair q q=cat parsed pair page page=2 parsed check body bytes 0 after blank line check has body no toy GET
Honesty boundary
NOTE: toy HTTP GET query only; not URL decoding beyond the pinned ASCII, repeated keys, arrays, form submission behavior, search ranking, privacy or tracking, caches, proxies, HTTP/2 or HTTP/3, auth, frameworks, or production server config.
toy query only \text{toy query only} toy query only Query honesty boundary The query bytes, parsed pairs, and empty body check are recomputed from pinned GET bytes. Query honesty boundary - GET /search query q=cat and page=2, body 0 bytes section name value check request line method GET parsed request line target display path /search question q=cat ampersand page=2 safe display form request line version HTTP/1.1 parsed header Host search.example exact target path /search before question mark query display words q=cat ampersand page=2 safe display form query exact hex 713d63617426706167653d32 pinned bytes pair q q=cat parsed pair page page=2 parsed check body bytes 0 after blank line check has body no toy GET
No client compute
The page shows already validated rows. It does not parse the URL in browser code.
static validated rows \text{static validated rows} static validated rows Query honesty boundary The query bytes, parsed pairs, and empty body check are recomputed from pinned GET bytes. Query honesty boundary - GET /search query q=cat and page=2, body 0 bytes section name value check request line method GET parsed request line target display path /search question q=cat ampersand page=2 safe display form request line version HTTP/1.1 parsed header Host search.example exact target path /search before question mark query display words q=cat ampersand page=2 safe display form query exact hex 713d63617426706167653d32 pinned bytes pair q q=cat parsed pair page page=2 parsed check body bytes 0 after blank line check has body no toy GET
Summary
A query string can carry small choices after the path.
query carries choices \text{query carries choices} query carries choices Query honesty boundary The query bytes, parsed pairs, and empty body check are recomputed from pinned GET bytes. Query honesty boundary - GET /search query q=cat and page=2, body 0 bytes section name value check request line method GET parsed request line target display path /search question q=cat ampersand page=2 safe display form request line version HTTP/1.1 parsed header Host search.example exact target path /search before question mark query display words q=cat ampersand page=2 safe display form query exact hex 713d63617426706167653d32 pinned bytes pair q q=cat parsed pair page page=2 parsed check body bytes 0 after blank line check has body no toy GET