From Gnash Project Wiki
Normative Standards Documents
- RFC 2616, Hypertext Transfer Protocol -- HTTP/1.1. Also available by FTP from isi.edu and with much better formatting at w3.org.
As of this writing, this is the most current HTTP definition.
- RFC 2396 Uniform Resource Identifiers (URI): Generic Syntax (August 1998), obsoleted by RFC 3986.
The HTTP/1.1 definition incorporates a definition for URI's; this is the one referenced, although it has been obsoleted in the interim.
Older Standards Documents
- RFC 1738 Uniform Resource Locators (URL) (December 1994), updated by RFC 3986.
- RFC 1808 Relative Uniform Resource Locators (June 1995), obsoleted by RFC 3986
- RFC 2732 Format for Literal IPv6 Addresses in URL's (December 1999), obsoleted by RFC 3986
Difficulties with the Standards
- All section references are to RFC 2616.
- The first URI reference is in Section 1.1:
It builds on the discipline of reference provided by the Uniform Resource Identifier (URI) , [...]
The footnote points to RFC 1630, Universal Resource Identifiers in WWW, which, one would think, would have been obsoleted by now. This one matters little, though, since it's not referenced as normative.
- The normative URI reference is in Section 3.2:
For definitive information on URL syntax and semantics, see "Uniform Resource Identifiers (URI): Generic Syntax and Semantics," RFC 2396 
Now it doesn't say "this standard as it might be updated in the future". We may conclude that HTTP/1.1 has a fixed URI definition that doesn't update when its incorporated reference does. This may have been the intent of the authors, but it's hardly the universal intent of implementors.
- The use of a URI in a Request (this includes the GET method) is defined in Section 5.1:
Request-URI = "*" | absoluteURI | abs_path | authority
In particular, the request does not admit a relative URI reference. The following example was in the original cygnal code:
GET /software/gnash/tests/flvplayer2.swf?file=http://localhost:4080/software/gnash/tests/lulutest.flv HTTP/1.1
Now the request-URI in this example is legal as a relative URI reference, but it's not legal according to the standard. It's not absoluteURI, since it doesn't begin with a scheme, which would be http. It's not abs_path, because it has a query appended to it, starting with "?".
- The current specification that a relative URI reference does not produce Request-URI seems contrary to client practice. Therefore, Cygnal will accept HTTP requests according to the following redefinition of Request-URI:
Request-URI = "*" | absoluteURI | abs_path | authority | relative-ref
where we take the definition of relative-ref mostly from RFC 3986, altering it to require that it be non-empty.