# Basic question about URL to use when making a request

**URL:** <https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605>\
**Category:** Build a Solid App\
**Created:** [August 21, 2021, 6:49am UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605 "2021-08-21T06:49:40Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 6:49am UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/1 "2021-08-21T06:49:40Z")

</div>

Hi! I’m working on a server app, written in Swift. So, am building up some networking request code of my own. I’m working from [solid-spec/api-rest.md at master · solid/solid-spec · GitHub](https://github.com/solid/solid-spec/blob/master/api-rest.md)

In related work, I’m already able to get a refresh token, generate access tokens, and sign DPoP’s (see [GitHub - crspybits/SolidAuthSwift: Swift-based authentication for a Solid Pod](https://github.com/crspybits/SolidAuthSwift.git)).

I’m trying to figure out what URL to use when making a request. For example, in [solid-spec/api-rest.md at master · solid/solid-spec · GitHub](https://github.com/solid/solid-spec/blob/master/api-rest.md) they give an example for container creation:

```auto
POST / HTTP/1.1
Host: example.org
Content-Type: text/turtle
Link: <http://www.w3.org/ns/ldp#BasicContainer>; rel="type"
Slug: data

```

Using URLSession and URLRequest to make the actual networking request in Swift, along with this, I pass additional headers:

```auto
authorization: "DPoP <ACCESSTOKEN>",
dpop: "<DPOPTOKEN>"

```

where `<ACCESSTOKEN>` is the access token I’ve successfully obtained from the solid server, and `<DPOPTOKEN>` is the signed DPoP token I’ve generated.

I have an account on [inrupt.net](http://inrupt.net) ([https://crspybits.inrupt.net/profile/card#me](https://crspybits.inrupt.net/profile/card#me)), but using that URL in place of the `Host` above isn’t working.

E.g., I get back:

```auto
"<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <title>Log in</title>\n <link rel=\"stylesheet\" href=\"/common/css/bootstrap.min.css\">\n <link rel=\"stylesheet\" href=\"/common/css/solid.css\">\n</head>\n<body>\n<div class=\"container\">\n <div class=\"page-header\">\n <div class=\"pull-right\">\n <button id=\"register\" type=\"button\" class=\"btn btn-primary\">Register</button>\n <button id=\"login\" type=\"button\" class=\"btn btn-success\">Log in</button>\n <button id=\"logout\" type=\"button\" class=\"hidden btn btn-danger\">Log out</button>\n </div>\n <h1>Log in to access this resource</h1>\n </div>\n\n <div class=\"alert alert-danger\">\n <p>\n The resource you are trying to access\n (<code>https://crspybits.inrupt.net/profile/card</code>)\n requires you to log in.\n </p>\n </div>\n\n</div>\n</div>\n<script src=\"/common/js/solid-auth-client.bundle.js\"></script>\n<script src=\"/common/js/auth-buttons.js\"></script>\n</body>\n</html>"

```

which I assume just means I’m using the wrong URL. Any suggestions appreciated.

Happy to share the specific Swift code, but this just seems like a basic question.

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 3:06pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/2 "2021-08-21T15:06:07Z")

</div>

It looks like you are trying to POST to you profile. I’d be very careful about that since if you mess up your profile, it will be hard to access your pod. Also in a POST the Host should be the parent Container and the Slug should be the resource. Content you want to send should be in the body. So if I want to POST to [http://example.org/foo/bar.ttl](http://example.org/foo/bar.ttl) my POST would have [http://example.org/foo/](http://example.org/foo/) as the Host an bar.ttl as the Slug. But also be aware that POST will not behave as you expect - if the resource already exists, POST will create a duplicate with a random number prefixed on the file name. Use PUT to overwrite a resource.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 4:49pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/3 "2021-08-21T16:49:21Z")

</div>

Thanks, @jeffz! So, in my case with my account `https://crspybits.inrupt.net` what would `http://example.org` be replaced with from your example?

I just tried that. I used these headers:

```auto
"Content-Type": "text/turtle"
"Link": "<http://www.w3.org/ns/ldp#BasicContainer>; rel=\"type\""
"Dpop": "<snip>"
"Authorization": "DPoP <snip>"
"Slug": "NewDirectory"

```

I sent the request to:

```auto
https://crspybits.inrupt.net

```

I get:  
Response: 401 status code, and:

```auto
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Log in</title>
  <link rel="stylesheet" href="/common/css/bootstrap.min.css">
  <link rel="stylesheet" href="/common/css/solid.css">
</head>
<body>
<div class="container">
  <div class="page-header">
    <div class="pull-right">
      <button id="register" type="button" class="btn btn-primary">Register</button>
      <button id="login" type="button" class="btn btn-success">Log in</button>
      <button id="logout" type="button" class="hidden btn btn-danger">Log out</button>
    </div>
    <h1>Log in to access this resource</h1>
  </div>

  <div class="alert alert-danger">
    <p>
      The resource you are trying to access
      (<code>https://crspybits.inrupt.net/</code>)
      requires you to log in.
    </p>
  </div>

</div>
</div>
<script src="/common/js/solid-auth-client.bundle.js"></script>
<script src="/common/js/auth-buttons.js"></script>
</body>
</html>

```

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 4:56pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/4 "2021-08-21T16:56:38Z")

</div>

“[https://crspybits.inrupt.net](https://crspybits.inrupt.net)” is an IDP address - it has no trailing slash when used to identify an oidc-issuer. But it is not a valid Solid URL which needs to end in a slash if it is a container. So if your new container is named “foo”, your POST should have host=“[https://crispybits.inrupt.net/](https://crispybits.inrupt.net/)” and slug=“foo”. That should create the container [https://crispybits.inrupt.net/foo/](https://crispybits.inrupt.net/foo/)".

However, the error you are showing is an unauthorized error. Perhaps that’s an artifact of using the wrong host or else your DPoP stuff is wrong, or else your app is not listed as a trustedApp in your profile.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 5:11pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/5 "2021-08-21T17:11:35Z")

</div>

Hmmm. Just put a trailing slash on `https://crispybits.inrupt.net/` and same result. The DPoP stuff being wrong is possible, though I have used it to successfully request the access token ([Solid OIDC Primer](https://solid.github.io/solid-oidc/primer/#authorization-code-pkce-flow-step-14)).

I’m not knowing about the `trustedApp` part. I think I’ve pretty carefully carried out the steps in [Solid OIDC Primer](https://solid.github.io/solid-oidc/primer/#solid-oidc-flow). I certainly haven’t taken any steps on the issuer side (e.g., through a web UI) to make my app a `trustedApp`. Not sure either how that would work right now since my “app” is just some test code running on my laptop.

Not seeing anything useful looking on a web search for “trustedApp Solid Project”. Could you please pass me some references?

Thanks!

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 5:25pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/6 "2021-08-21T17:25:14Z")

</div>

The trustedApp protocol is NOT in the spec and will be replaced but IS currently enforced on NSS servers like [inrupt.net](http://inrupt.net) for browser-based apps but is not enforced for out-of-browser apps. So, unless you are sending your requests via a localhost or other browser-based context, you shouldn’t need to worry about trustedApps. The only docs on trustedApps I know about are here : [GitHub - solid/userguide: userguide to data browser](https://github.com/solid/userguide#manage-your-trusted-applications)

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 5:29pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/7 "2021-08-21T17:29:03Z")

</div>

Just signed into the Solid web UI for my account, and I see the trusted app setup.

 ![Screen Shot 2021-08-21 at 11.25.01 AM](https://europe1.discourse-cdn.com/flex017/uploads/solidproject/original/2X/d/d651f234f58aa503c27231c004d0012bd299f2bf.png)

From what I can tell, my app is indeed a trusted app. I.e., this is my application URL `biz.spasticmuffin.neebla.demo://`– good to see this in the web UI 🙂

I believe that got setup during the registration part of my authorization.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 5:31pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/8 "2021-08-21T17:31:00Z")

</div>

My requests are definitely not coming from a browser. They are coming from some Swift code running on Linux in a Docker container.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 6:10pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/9 "2021-08-21T18:10:39Z")

</div>

It seems like I need to overtly use a `host` header. I’d not been using one. Not sure in my case what it’s value ought to be but I just tried:

```auto
host: crspybits.inrupt.net

```

and

```auto
host: inrupt.net

```

and in both cases, I get the same error as above.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 6:21pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/10 "2021-08-21T18:21:20Z")

</div>

Drum roll please…

It’s working! My first working request:

 ![Screen Shot 2021-08-21 at 12.16.25 PM](https://europe1.discourse-cdn.com/flex017/uploads/solidproject/original/2X/8/8ac43a3af40a2721cd06e34fc3429a28ae3ce3b4.png)

I had been getting one of the claims in my DPoP incorrect.

Specially, the `htu` field in the DPoP body was supposed to be the URL I was using in the request, but it actually wasn’t.

I also did use:

```auto
host: crspybits.inrupt.net

```

in this successful request.

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 6:22pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/11 "2021-08-21T18:22:35Z")

</div>

👍👍 Congratulations!

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 6:25pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/12 "2021-08-21T18:25:35Z")

</div>

I should mention though that this doesn’t really test your login. The inbox, unless you changed its permissions is world-appendable so anyone can POST things there.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 6:26pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/13 "2021-08-21T18:26:25Z")

</div>

Thank you, and thanks for your help!! I’ll try to remember to post a link to the github repo with the working code. Have some cleanup to do.

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 6:28pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/14 "2021-08-21T18:28:31Z")

</div>

I’m not really understanding the `inbox` comment. My new directory doesn’t seem to be under my inbox.

 ![Screen Shot 2021-08-21 at 12.27.52 PM](https://europe1.discourse-cdn.com/flex017/uploads/solidproject/original/2X/7/7a1a3439358526ffcec6e70e2c5745397756d201.png)

Or am I missing something? I’m still pretty wet behind the ears when it comes to Solid.

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 6:29pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/15 "2021-08-21T18:29:16Z")

</div>

Oh, my bad eyes. I thought your new directory was inside the inbox. Nevermind. 🙂

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 21, 2021, 6:30pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/16 "2021-08-21T18:30:38Z")

</div>

Right. I was a bit confused about the UX of the nesting in the web UI too. Had to stare at it a bit. I’m not sure if my directory placement is conventional. What I intend in the end is to create a top level container/directory named for my app.

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 6:43pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/17 "2021-08-21T18:43:25Z")

</div>

“Top level” means different things on different servers. There is no reliable way to find a person’s pod storage space from a webid. You can climb the container tree till you find a container with a link header asserting that the container is a pim:Storage. Polite apps should ask the user where the app-specific data should be stored.

---

<div class="post-metadata">

**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\
**Post date:** [August 21, 2021, 7:06pm UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/18 "2021-08-21T19:06:47Z")

</div>

I’m submitting an issue about the indentation of the folders in the databrowser and I’ll use your screenshot as an example. :-). See [Make active item flush with siblings in databrowser · Issue #44 · solid/solidos · GitHub](https://github.com/solid/solidos/issues/44)

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 22, 2021, 2:15am UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/19 "2021-08-22T02:15:07Z")

</div>

> [@jeffz](#):
>
> Polite apps should ask the user where the app-specific data should be stored.

I’m assuming an answer to this question from the user would take the form of a path “foo1/foo2/foo3” etc. that I would then append to their base URL. E.g., in my case “[https://crspybits.inrupt.net/foo1/foo2/foo3](https://crspybits.inrupt.net/foo1/foo2/foo3)”. Is that what you mean?

---

<div class="post-metadata">

**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\
**Post date:** [August 22, 2021, 2:19am UTC](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605/20 "2021-08-22T02:19:46Z")

</div>

While I’m thinking of it, here’s the code, in Swift for the Solid component of my server:

> **[ServerSolidAccount/Sources/ServerSolidAccount/CloudStorage at main ·...](https://github.com/SyncServerII/ServerSolidAccount/tree/main/Sources/ServerSolidAccount/CloudStorage)**
>
> main/Sources/ServerSolidAccount/CloudStorage

Incomplete, but much of the basics are in place.

[Next page](https://forum.solidproject.org/t/basic-question-about-url-to-use-when-making-a-request/4605.md?page=2)