Recursive AI

Validate an HTTP or HTTPS URL in C#

OneContact is a free, open-source contact data library for .NET from Recursive AI. MIT or Apache-2.0, no native dependencies, no network access.

NuGet GitHub Docs Download example (.zip)

Check whether a string can be parsed as an HTTP or HTTPS web address. This checks syntax, not whether the website exists or is safe to visit.

Terminal
dotnet add package RecursiveAI.OneContact

Requires .NET 10 (net10.0); .NET 9 and earlier aren’t supported.

C#
using RecursiveAI.OneContact;
var input = "https://example.com";
bool valid = WebAddress.TryParse(
    input, out var url)
    && url.IsWebsite;
Console.WriteLine(valid);
Text
True

Bare domains are accepted as HTTPS; Variations shows how to require an explicit scheme.

Unzip the example, then dotnet run.

Full program

All sample input is written directly in the program.

C#
using RecursiveAI.OneContact;
 
string[] inputs = ["https://example.com/path", "example.com",
    "javascript:alert(1)", "https://example.com:99999"];
foreach (var input in inputs)
{
    bool valid = WebAddress.TryParse(input, out var url)
        && url.IsWebsite;
    Console.WriteLine($"{input} => {valid}");
}

dotnet run prints:

Text
https://example.com/path => True
example.com => True
javascript:alert(1) => False
https://example.com:99999 => False

TryParse returns false for rejected syntax; parsing alone also accepts non-website schemes, so keep the IsWebsite check.

Variations

Require the user to supply a scheme instead of accepting an assumed HTTPS scheme:

C#
using RecursiveAI.OneContact;
var input = "example.com";
bool valid = WebAddress.TryParse(
    input, out var url)
    && url.IsWebsite
    && !url.Flags.HasFlag(WebFacts.SchemeAssumed);
Console.WriteLine(valid);
Text
False

The short answer

Use WebAddress.TryParse(input, out var url) && url.IsWebsite for a Boolean HTTP-or-HTTPS check. Parsing success alone is not enough: OneContact accepts other URL schemes too. The full program shows four cases, including an assumed HTTPS scheme, a non-website scheme and an invalid port.

The result answers a syntax-and-scheme question. It does not check DNS, request a page, inspect a certificate or establish that a URL is trustworthy. OneContact’s web address documentation says its behavior depends on neither culture nor the network.

How do I check whether a string is a valid HTTP URL in C#?

First decide what the form means by valid. This example accepts HTTP and HTTPS and permits the parser to supply HTTPS when no scheme is written. example.com therefore returns True, just like the explicit https://example.com/path input. If your field requires a complete, explicitly written URL, use the variation, which rejects the SchemeAssumed flag.

An accepted value exposes Canonical, but canonicalization is another operation. The serializer normalizes the host and default port, removes known tracking parameters and removes the fragment. Credentials, path case and other query parameters stay as written. Keep the original text when the application must preserve the exact input, particularly if a fragment has meaning to the user.

The package reports transformations in its facts rather than silently pretending the input was unchanged. Those flags help explain why accepted text differs from the canonical form you display. Use a separate display decision instead of promising a byte-for-byte round trip through Canonical.

How do I validate a URL in C#?

For website fields, retain IsWebsite after TryParse. The documented parser accepts any WHATWG URL (the URL standard browsers use), including javascript: and data:. Those can be parsed URLs while still failing this page’s HTTP-or-HTTPS requirement. In the full program, javascript:alert(1) returns False because the second condition rejects it, not because all non-HTTP input is malformed.

The example’s invalid port returns False at the parsing step. Other documented failures include a missing host, an invalid host and invalid URL syntax. A Boolean check is convenient for a form; the library’s detailed parsing overloads expose reasons and field offsets if the application needs a more specific explanation.

Don’t interpret IsWebsite as a fetch policy. A syntactically acceptable HTTP address is not a promise that a server-side request is appropriate. This example makes no request at all. Any code that later retrieves a page needs its own rules for permitted destinations and how the response is used.

Should I use a regex to validate a URL?

For this task, use the parser instead of maintaining a separate pattern for every host and URL shape you intend to accept. The documented parsing rules include domain processing, internationalized hosts, IP addresses, ports and URL serialization. A pattern that merely finds a period or an https:// prefix does not answer the same question.

Keep policy checks explicit after parsing. Requiring HTTP or HTTPS and requiring a written scheme are separate choices in the two runnable snippets. Keeping those decisions visible is more useful than one unexplained “valid” pattern: a reader can see why the same bare domain is accepted by the first snippet and rejected by the variation. Neither result tells you whether the remote website is currently available.

All onecontact recipes