What to do about userinfo in URLs?

[glassfishrobot]

RFC 7230 section 2.7.1 http uri scheme states:

Before making use of an "http" URI reference received from an untrusted source, a recipient SHOULD parse for userinfo and treat its presence as an error; it is likely being used to obscure the authority for the sake of phishing attacks.

Now, granted, it's only a SHOULD, but I wonder if we need to heed this in Servlet?

[glassfishrobot]

• Issue Imported From: https://github.com/javaee/servlet-spec/issues/101
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @glassfishrobot

[glassfishrobot]

@glassfishrobot Commented Reported by @edburns

[glassfishrobot]

@glassfishrobot Commented markt_asf said: Given that the definition of "an untrusted source" is going to vary significantly on a case by case basis, I'd lean towards leaving this one to container specific configuration.

[glassfishrobot]

@glassfishrobot Commented This issue was imported from java.net JIRA SERVLET_SPEC-101

[stuartwdouglas]

I am +1 for closing this. I don't think the Servlet spec should be dealing with protocol level details, that is what the RFC's are for. Given that this is already specified in the RFC that the container is implementing I don't think we need to re-specify it.

[markt-asf]

+1 for closing