Repository navigation
Specify that percent-encoded domain names are unsupported #778
Description
If I go to %78.com in the browser, that takes me to x.com. Indeed in RFC9110 §3.2.2, percent-encoding is allowed in HTTPS authorities:
reg-name = *( unreserved / pct-encoded / sub-delims )
But, let's just save ourselves the trouble and forbid percent-encoding in domain names. FWIW, wasmtime fails if the host part of an authority has a %.
Activity
lann commentedon Oct 2, 2025
I agree. Percent encoding in the authority is only useful to encode non-ascii characters to ascii and wasi-http already represents authority as a unicode string.
Relatedly, I wonder if the spec should say anything about the whole IDNA/punycode/nameprep bag of worms? That could get very messy but there is probably an argument about avoiding canonicalization attacks in middleware, etc...