Re: [whatwg/url] Forbid < and > in hosts (#458)

>     1. What led to these characters being forbidden in Gecko?  Will we want to change this set of forbidden characters again after this?

Basically we use hostnames to compute "origin attributes" which is basically the origin + some other info we use to enforce security properties, and all of these characters were interfering with how we parse the origin attributes. Since they weren't supposed to appear in hostnames anyway, we decided to restrict them from appearing in the hostname.
https://bugzilla.mozilla.org/show_bug.cgi?id=1337629#c0
https://bugzilla.mozilla.org/show_bug.cgi?id=1548306

>     2. Are there any URLs with custom schemes with those in their host?  This is harder to find out. I hope the compatibility risk is minimal but I don't have a good way to find out except changing it and seeing which things break.  This is also a nudge to Chrome and Firefox to implement hosts in URLs with custom schemes according to the spec.

I'm making progress in Firefox on that front. Tracking that work in:
https://bugzilla.mozilla.org/show_bug.cgi?id=1603699

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/458#issuecomment-565386976