3 ms·
Why not just delete the url bar contents after attempting that url or something? Or take to a warning page.
by cma 3y ago
Why not just delete the url bar contents after attempting that url or something? Or take to a warning page.
- btilly 3y agoAny such decision requires no longer honoring https://www.rfc-editor.org/rfc/rfc1738 https://www.rfc-editor.org/rfc/rfc1738.
- cxr 3y agoPlease be more specific.
- btilly 3y agoSection 3.1 specifies /<user>:<password>@<host>:<port>/<url-path> Which means if you're presented with that and don't send it to that host, you've violated the RFC. But this was demonstrably resulting in confused users being sent to scammer's domains.
- cxr 3y agoThat ("if you're presented with that and don't send it to that host, you've violated the RFC") has nothing to do with the comment you responded to, which described a UI choice compatible with RFC 3986, which says "Applications should not render as clear text any data after the first colon (":") character found within a userinfo subcomponent" (and which also goes on to say "Applications may choose to ignore or reject such data when it is received as part of a reference").