Re: [whatwg/url] Disallow comma in hosts (#390)

Since this is really an HTTP delimiter issue I don't think this is a good argument for locking down hosts more. We can't use all possible delimiters to influence what to allow in a host. CORS could possibly forbid "," or this is just an oddity where multiple headers, when combined by an intermediary that uses "," and not ", " (trailing space), end up being treated identically to a single header containing the combined value (when combined with ",").

As such, I'm going to close this. Testing might still be good, though since browsers are forced to combine using ", " (with trailing space) before "parsing" they will always fail as spaces are not allowed in HTTP(S) hosts.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/url/issues/390#issuecomment-2514474013
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/url/issues/390/2514474013@github.com>