Wildcard certs should only validate one level of sub domain#14249
Conversation
|
Note that I believe partial wildcards ( I’m not making any judgement on this either way, just stating some information that may be helpful. |
Thanks for the info! I'll wait for more feedback before making any adjustments. Your point does seem valid. |
|
Thanks for this! I'd like to follow the lead set by the major browsers. I agree with @mitchellh's interpretation of the spec, that partial wildcards are not required, and in fact appear to be discouraged. Given that
I think it's clear that the best path forward for Zig is to not look for partial wildcards. |
@andrewrk Thanks for the clarification, I've gone ahead and removed the fragment component implementation. |
Closes #14177
The following testcase was included in the RFC spec, but not explicitly mentioned in the issue. I went ahead and implemented it.
Do we want to expand this to cases like
zig*ng.orgmatchingziglang.org? I could not find any reference to it in the spec, but I imagine the above quote implying thatzig*ng.orgwould need to pass as well.