REGEXVAULTv2.0
Web & Network/URL
Verified Safe

URL Protocol-Relative Regex for Python

/^//(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}(?::(?:6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?(?:/[^\s]*)?$/

What this pattern does

This page provides a comprehensive, battle-tested regular expression for matching url protocol-relative, ported and verified for Python. A rigorously tested regex reduces debugging time and protects your application from edge-case failures. The snippet below is ready to drop into your Python project — whether you're validating in a Django view, a FastAPI endpoint, or a standalone data processing script.

Python Implementation

Python
# URL Protocol-Relative
# ReDoS-safe | RegexVault — Web & Network > URL

import re

url_protocolrelative_pattern = re.compile(r'^//(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}(?::(?:6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?(?:/[^\s]*)?$')

def validate_url_protocolrelative(value: str) -> bool:
    return bool(url_protocolrelative_pattern.fullmatch(value))

# Example
print(validate_url_protocolrelative("//example.com"))  # True

Test Cases

Matches (Valid)
Rejects (Invalid)
//example.comhttps://example.com
//cdn.example.com/script.js/path/only
//api.example.com:8080/resource//
//example.co.uk/path//example.com:99999
//static.example.com/img/logo.png// example.com

When to use this pattern

This pattern is drawn from the Web & Network > URL category and carries a ReDoS-safe certification. That matters for Python developers because particularly important in Python web servers where CPU-bound regex operations can stall concurrent request handling. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

A protocol-relative URL on an HTTP page resolves to http:// — this is a potential security downgrade. Always resolve to explicit HTTPS in security-sensitive contexts.

Technical Notes

Protocol-relative URLs are deprecated in modern development. Prefer explicit https:// to avoid downgrade attacks when embedded in mixed-content pages.

Have a pattern that belongs in the vault?

Submit it for review — community-verified patterns get credited to your GitHub handle. Free submissions join the queue. Priority review available for $15.

Submit a Pattern