4 ms·
Browsers do that for a good reason. They used to do the protocol, username, password, host, pathname, etc. But scammers used it to have a user name that looked
by btilly 3y ago
Browsers do that for a good reason.
They used to do the protocol, username, password, host, pathname, etc. But scammers used it to have a user name that looked like a well-known URL, while actually directing the user to a domain under the scammer's control. Not honoring the spec was therefore a security feature.
- cma 3y agoWhy not just delete the url bar contents after attempting that url or something? Or take to a warning page.
- btilly 3y agoAny such decision requires no longer honoring https://www.rfc-editor.org/rfc/rfc1738 https://www.rfc-editor.org/rfc/rfc1738.
- cxr 3y agoPlease be more specific.
- btilly 3y agoSection 3.1 specifies /<user>:<password>@<host>:<port>/<url-path> Which means if you're presented with that and don't send it to that host, you've violated the RFC. But this was demonstrably resulting in confused users being sent to scammer's domains.
- cxr 3y agoThat ("if you're presented with that and don't send it to that host, you've violated the RFC") has nothing to do with the comment you responded to, which described a UI choice compatible with RFC 3986, which says "Applications should not render as clear text any data after the first colon (":") character found within a userinfo subcomponent" (and which also goes on to say "Applications may choose to ignore or reject such data when it is received as part of a reference").