Re: [whatwg/url] Unicode normalization could change the structure of a URL (#626)

That seems like an issue with the authorization server (and potentially older versions of IE/Edge). Why would it not send back the serialization of what it parsed? Also, who does the normalization from `＃` to `#`? That's not allowed.

It's also not clear how this relates to STD3 as that is purely about ASCII code points and doesn't do normalization of non-ASCII code points as far as I know. (And you cannot outlaw `https://evil.com#@google.com` as that's a perfectly valid URL string; identical to `https://evil.com/#@google.com`.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/626#issuecomment-892657025