4 ms·

Technically speaking, adding a period at the end of a URL is valid in that it implicitly exists for all URLs in the context of DNS. Your browser doesn't care ho

Technically speaking, adding a period at the end of a URL is valid in that it implicitly exists for all URLs in the context of DNS. Your browser doesn't care however and while not exactly niche, I don't think it's widely known either. Funnily enough, typing a URL" "correctly" such as https://amazon.com https://amazon.com. (make sure to include the trailing dot!) can actually cause some load balancers to freak out and serve no or even garbled content! It's pretty neat and this is definitely a tangent. Either way, you don't want your camera mucking with the contents of a QR code

aaronharnly 5y ago
Yeah, it seems this just isn’t recognizing the “end” of the domain part correctly :)
numpad0 5y ago
It's not period at the end, article claims it modifies domain names and subdomains, e.g. www2.example.edu into www.2.examp.le.edu, supposedly when it could match `www` or a second level domain.
jamesfinlayson 5y ago
My QA found this out recently - he'd accidentally typed a . at the end of the URL for one of our test servers which ended up breaking CORS - it certainly took us a while to figure that one out.
kuschku 5y ago
Nginx and Apache handle this just fine, as does Google's, Microsoft's and Facebook's infra. It's only hipster services such as traefik and caddy that can't handle this. There's a long standing bug on the caddy bugtracker for this, which got closed as wontfix: working as intended.
- AaronFriel 5y ago
  That's really unfortunate, the trailing dot indicates that it is a fully qualified domain name and I've used this when writing tests, for example, to ensure that a hostname either resolves to some internally served DNS label _or none at all_.
  - kuschku 5y ago
    Or when you're writing a thumbnail generator bot that's supposed to generate previews of webpages, but you want to ensure domains aren't resolved relative to your local search domain. The "fix" seems to be modifying the client you use to trim suffixed dots from the Host header and SNI. But it'd be much simpler if Caddy & Traefik would juat comply with the standards.
  - dylan604 5y ago
    See, now I have to wonder if you put 'all_.' as full stop to your written sentence, or as part of a FQ pseudo code in online forum style with no grammatical punctuation. AHHHH!!!
judge2020 5y ago
It also seems to use different cookies, I'm not logged into Amazon with a trailing dot.
- recursive 5y ago
  It's a different origin.
nanis 5y ago
> Technically speaking, adding a period at the end of a URL is valid in that it implicitly exists for all URLs in the context of DNS. I think your are confusing the role of a trailing dot in the DNS[1] system with the role of a host element in a URI[2]. So, technically speaking, adding a period at the end of a URL is really not OK because `https://example.com/index.html https://example.com/index.html` and `https://example.com/index.html https://example.com/index.html.` are different resources. (note that HN's URL linking logic omits the trailing dot.) I can understand if you think there should be no difference between `https://example.com/ https://example.com/` and `https://example.com./ https://example.com./` and that is legitimate per the RFC: > The rightmost domain label of a fully qualified domain name in DNS may be followed by a single "." and should be if it is necessary to distinguish between the complete domain name and some local domain. but there is no reason to expect that adding a period at the end of any old URI is going to work. [1]: https://serverfault.com/a/18122 https://serverfault.com/a/18122 [2]: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2 https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
- tialaramex 5y ago
  Although it is valid in DNS, it is not valid in the TLS SNI. If you tell the remote server you wanted some.name.example. with that extra dot at the end that's an error and it should tell you to go away. All the names in SNI should be real names and not some locally qualified name, the alternative would be confusing because these are identities and so it doesn't mean anything to have proof you're really "testserver4" we want to know whether you're really "testserver4.mycorp.example" or not.
  - DHowett 5y ago
    This seems exactly backwards, though. “testserver4.mycorp.example” (no trailing dot) is not fully-qualified and as such could refer to any number of things of differing identities, e.g. “testserver4.mycorp.example.atthomenetwork.com”. On the other hand, “testserver4.mycorp.example.” (trailing dot) is fully-qualified and is not an ambiguous identity.
    - 5y ago
kragen 5y ago
The trailing period is often useful for breaking malicious JS and cookies on the page.
betenoire 5y ago
This used to be a reliable workaround to "web nannies" or corporate filters as well.
Seb-C 5y ago
Not even mentioning that while theoretically valid, it can break things such as signed urls.

aaronharnly 5y ago

Yeah, it seems this just isn’t recognizing the “end” of the domain part correctly :)

numpad0 5y ago

It's not period at the end, article claims it modifies domain names and subdomains, e.g. www2.example.edu into www.2.examp.le.edu, supposedly when it could match `www` or a second level domain.

jamesfinlayson 5y ago

My QA found this out recently - he'd accidentally typed a . at the end of the URL for one of our test servers which ended up breaking CORS - it certainly took us a while to figure that one out.

kuschku 5y ago

Nginx and Apache handle this just fine, as does Google's, Microsoft's and Facebook's infra. It's only hipster services such as traefik and caddy that can't handle this. There's a long standing bug on the caddy bugtracker for this, which got closed as wontfix: working as intended.

AaronFriel 5y ago
That's really unfortunate, the trailing dot indicates that it is a fully qualified domain name and I've used this when writing tests, for example, to ensure that a hostname either resolves to some internally served DNS label _or none at all_.
- kuschku 5y ago
  Or when you're writing a thumbnail generator bot that's supposed to generate previews of webpages, but you want to ensure domains aren't resolved relative to your local search domain. The "fix" seems to be modifying the client you use to trim suffixed dots from the Host header and SNI. But it'd be much simpler if Caddy & Traefik would juat comply with the standards.
- dylan604 5y ago
  See, now I have to wonder if you put 'all_.' as full stop to your written sentence, or as part of a FQ pseudo code in online forum style with no grammatical punctuation. AHHHH!!!

judge2020 5y ago

It also seems to use different cookies, I'm not logged into Amazon with a trailing dot.

recursive 5y ago
It's a different origin.

nanis 5y ago

> Technically speaking, adding a period at the end of a URL is valid in that it implicitly exists for all URLs in the context of DNS. I think your are confusing the role of a trailing dot in the DNS[1] system with the role of a host element in a URI[2]. So, technically speaking, adding a period at the end of a URL is really not OK because `https://example.com/index.html https://example.com/index.html` and `https://example.com/index.html https://example.com/index.html.` are different resources. (note that HN's URL linking logic omits the trailing dot.) I can understand if you think there should be no difference between `https://example.com/ https://example.com/` and `https://example.com./ https://example.com./` and that is legitimate per the RFC: > The rightmost domain label of a fully qualified domain name in DNS may be followed by a single "." and should be if it is necessary to distinguish between the complete domain name and some local domain. but there is no reason to expect that adding a period at the end of any old URI is going to work. [1]: https://serverfault.com/a/18122 https://serverfault.com/a/18122 [2]: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2 https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2

tialaramex 5y ago
Although it is valid in DNS, it is not valid in the TLS SNI. If you tell the remote server you wanted some.name.example. with that extra dot at the end that's an error and it should tell you to go away. All the names in SNI should be real names and not some locally qualified name, the alternative would be confusing because these are identities and so it doesn't mean anything to have proof you're really "testserver4" we want to know whether you're really "testserver4.mycorp.example" or not.
- DHowett 5y ago
  This seems exactly backwards, though. “testserver4.mycorp.example” (no trailing dot) is not fully-qualified and as such could refer to any number of things of differing identities, e.g. “testserver4.mycorp.example.atthomenetwork.com”. On the other hand, “testserver4.mycorp.example.” (trailing dot) is fully-qualified and is not an ambiguous identity.
  - 5y ago

kragen 5y ago

The trailing period is often useful for breaking malicious JS and cookies on the page.

betenoire 5y ago

This used to be a reliable workaround to "web nannies" or corporate filters as well.

Seb-C 5y ago

Not even mentioning that while theoretically valid, it can break things such as signed urls.