URL Protocol-Relative Regex for Python
/^//(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}(?::(?:6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?(?:/[^\s]*)?$/What this pattern does
This page provides a comprehensive, battle-tested regular expression for matching url protocol-relative, ported and verified for Python. A rigorously tested regex reduces debugging time and protects your application from edge-case failures. The snippet below is ready to drop into your Python project — whether you're validating in a Django view, a FastAPI endpoint, or a standalone data processing script.
Python Implementation
# URL Protocol-Relative
# ReDoS-safe | RegexVault — Web & Network > URL
import re
url_protocolrelative_pattern = re.compile(r'^//(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}(?::(?:6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[1-9][0-9]{0,3}))?(?:/[^\s]*)?$')
def validate_url_protocolrelative(value: str) -> bool:
return bool(url_protocolrelative_pattern.fullmatch(value))
# Example
print(validate_url_protocolrelative("//example.com")) # TrueTest Cases
Matches (Valid) | Rejects (Invalid) |
|---|---|
//example.com | https://example.com |
//cdn.example.com/script.js | /path/only |
//api.example.com:8080/resource | // |
//example.co.uk/path | //example.com:99999 |
//static.example.com/img/logo.png | // example.com |
When to use this pattern
This pattern is drawn from the Web & Network > URL category and carries a ReDoS-safe certification. That matters for Python developers because particularly important in Python web servers where CPU-bound regex operations can stall concurrent request handling. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.
Common Pitfalls
A protocol-relative URL on an HTTP page resolves to http:// — this is a potential security downgrade. Always resolve to explicit HTTPS in security-sensitive contexts.
Technical Notes
Protocol-relative URLs are deprecated in modern development. Prefer explicit https:// to avoid downgrade attacks when embedded in mixed-content pages.
Have a pattern that belongs in the vault?
Submit it for review — community-verified patterns get credited to your GitHub handle. Free submissions join the queue. Priority review available for $15.
Submit a Pattern