"legitimate" is highly subjective in this instance. Personally, I would argue that there's none. The only use case I can think of is submitting a form with arbi

"legitimate" is highly subjective in this instance. Personally, I would argue that there's none. The only use case I can think of is submitting a form with arbitrary text in a field value, but most such submits should be POSTed. The main exception - search keywords - are a lot less likely to need to support repeating whitespace. However, a better question is: do a lot of legitimate websites in the wild put multiple spaces in the address field. Obvious answer is that millions do, so there's nothing browsers can really do here.