5 ms·
Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just
by wycy 8y ago
Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.
- stedaniels 8y agoIs been an RFC for almost a decade, RFC5785 [0]. Mattias Geniar has a good write up on it [1]. [0] https://tools.ietf.org/html/rfc5785 https://tools.ietf.org/html/rfc5785 [1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-5785/ https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...
- wycy 8y agoInteresting. I guess I've been out of the web dev scene for a little over a decade now, so that makes sense.
- jolmg 8y agoNeither seems to explain why these files aren't just placed in root, like robots.txt. What's the point of having a subpath? The RFC says: > 2. Why /.well-known? It's short, descriptive, and according to search indices, not widely used. This gives reasoning for the name of the subpath, but not its existence.
- ezrast 8y agoTo minimize collisions, and so we're not retreading this argument in another ten years: https://news.ycombinator.com/item?id=19063727 https://news.ycombinator.com/item?id=19063727
- jolmg 8y agoOk, yeah. It occurs to me that websites might want the whole path to be variable text, maybe user defined. This would also answer the question I've had for so long as to why Wikipedia chose to have /wiki/ before article titles in their URLs. I guess it was so that the article https://en.wikipedia.org/wiki/robots.txt https://en.wikipedia.org/wiki/robots.txt did not collide with their robots.txt file. Would've been nice if that explanation were included in the RFC.
- fb03 8y ago.well-known is also used for ACME for auto-certificate generation and renewal. I still would like to know the backstory around this folder, just like OP.
- cyphar 8y agoIt's a standard directory with an RFC and all[1] and is widely used for a whole bunch of things, not just LetsEncrypt (such as WebDav). [1]: https://tools.ietf.org/html/rfc5785 https://tools.ietf.org/html/rfc5785
- amaccuish 8y agoFYI .htaccess shouldn't generally be publically readable, as it's for your webserver, not the public. It's also only relevant to the directory it's in, hence why it's not in a separate directory.
- system2 8y agonginx is your friend.
- cabaalis 8y agoWhy are dotfiles generally considered "hidden" and not to be served (such as .htaccess, .env, etc) but .well-known is expressly intended to be served? It should have just been named well-known, IMO.
- geofft 8y agoBecause that made it unlikely to collide with existing / claimable uses. Consider https://github.com/well-known https://github.com/well-known or https://instagram.com/well-known https://instagram.com/well-known .
- josefresco 8y agoI was working on a shared hosting environment (EIG) and saw this newly created directory (well-known) and promptly freaked. I viewed that dir and inside was "acme-challenge" and I freaked even more, thinking my client had been hacked. Was very happy to see this was not a hack, but found the naming conventions very odd.
- dddddaviddddd 8y agoUsed by the Let's Encrypt client to verify site ownership.
- josefresco 8y agoI know that now ;-) but it was about 5 minutes of panic until I found my answer on Google.
- chrisweekly 8y agoAuth0 also uses a "/.well-known/" URL path prefix as the default location for public keys.
- cestith 8y agoIt's used for a number of other things, from proof of control for cert issuers to information for OIDC. One of its main advantages is that it's self-describing. That is, it's a well-known place to put this sort of metadata about a site.