Find the Query

Request Target

The GET request target carries the toy choices.

highlighted = computed this step

The request uses GET

The request line starts with GET and carries the search target.

GET request target\text{GET request target}
GET request targetThe request target, query rows, Host header, and empty body check are recomputed from pinned bytes.GET request target - GET /search query q=cat and page=2, body 0 bytessectionnamevaluecheckrequest linemethodGETparsedrequest linetarget displaypath /search question q=cat ampersand page=2safe display formrequest lineversionHTTP/1.1parsedheaderHostsearch.exampleexacttargetpath/searchbefore question markquerydisplay wordsq=cat ampersand page=2safe display formqueryexact hex713d63617426706167653d32pinned bytespairqq=catparsedpairpagepage=2parsedcheckbody bytes0after blank linecheckhas bodynotoy GET

The target has a query part

The table uses safe display words for the target, while the exact target is checked from the pinned request bytes.

target checked from bytes\text{target checked from bytes}
GET request targetThe request target, query rows, Host header, and empty body check are recomputed from pinned bytes.GET request target - GET /search query q=cat and page=2, body 0 bytessectionnamevaluecheckrequest linemethodGETparsedrequest linetarget displaypath /search question q=cat ampersand page=2safe display formrequest lineversionHTTP/1.1parsedheaderHostsearch.exampleexacttargetpath/searchbefore question markquerydisplay wordsq=cat ampersand page=2safe display formqueryexact hex713d63617426706167653d32pinned bytespairqq=catparsedpairpagepage=2parsedcheckbody bytes0after blank linecheckhas bodynotoy GET

The version token is pinned

The request line ends with the pinned HTTP version token.

HTTP version token\text{HTTP version token}
GET request targetThe request target, query rows, Host header, and empty body check are recomputed from pinned bytes.GET request target - GET /search query q=cat and page=2, body 0 bytessectionnamevaluecheckrequest linemethodGETparsedrequest linetarget displaypath /search question q=cat ampersand page=2safe display formrequest lineversionHTTP/1.1parsedheaderHostsearch.exampleexacttargetpath/searchbefore question markquerydisplay wordsq=cat ampersand page=2safe display formqueryexact hex713d63617426706167653d32pinned bytespairqq=catparsedpairpagepage=2parsedcheckbody bytes0after blank linecheckhas bodynotoy GET

Summary

The choices are part of the request target, not hidden browser code.

target carries choices\text{target carries choices}
GET request targetThe request target, query rows, Host header, and empty body check are recomputed from pinned bytes.GET request target - GET /search query q=cat and page=2, body 0 bytessectionnamevaluecheckrequest linemethodGETparsedrequest linetarget displaypath /search question q=cat ampersand page=2safe display formrequest lineversionHTTP/1.1parsedheaderHostsearch.exampleexacttargetpath/searchbefore question markquerydisplay wordsq=cat ampersand page=2safe display formqueryexact hex713d63617426706167653d32pinned bytespairqq=catparsedpairpagepage=2parsedcheckbody bytes0after blank linecheckhas bodynotoy GET