Re: [whatwg/url] Should we ignore IPv6 zone identifiers when parsing a URL? (Issue #742)

> As I understand it the use case for ignoring it is that sometimes you might happen across a URL (such as with a printer) and the zone ID doesn't matter because the default zone also works. How common is that for most end users?

The default zone working seems pretty likely.  Though the usage of zone identifiers in URLs likely approaches zero (yes, in part due to browsers not supporting them), it would be very rare for the same IPv6 address to be assigned to different hosts and for those two hosts to be attached to different interfaces on the same machine.

The most likely scenario is where there are site- or link-local addresses that collide. And when I say "most likely", it takes a LOT of hosts (>2<sup>32</sup>) on the two attached networks before the probability of a collision becomes non-trivial.

That erasure is very likely to work is why we entertained it.  But @annevk's point about various types of request smuggling ("`https://[x::y2]/` is forbidden, but `https://[x::y%32]` is OK because "x::y" is OK" .. or vice versa) make me think that it is easier to generate an error and be done.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/742#issuecomment-1399821138
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/742/1399821138@github.com>