18

Is it safe to use http(s)://CompanyName.com/xyz as URL (e.g. for branding purposes) without any changes to the service-side configs?

I know that DNS is case-insensitive, but could there still be side-effects? I am thinking of e.g. various parts of the chain failing to match CompanyName.com ~ companyname.com:

  • Some web backend might fail to match
  • Some load balancer/proxy/cache/application layer firewall might fail to match
  • Some client might apply same-origin policies wrongly
  • Some client might fail to match in certificate checks
  • While DNS is generally case-insensitive, could IDNs change the picture?

Anyone experienced those or other issues with capitals in the hostname part of URLs?

[edit] @Michael Hampton pointed out that, according the the HTTP standards, the hostname IS case-insensitive, but some software is non-compliant in this regard.

I try to get a sense of how prevalent non-compliant software is, in particular clients. I assume all recent major browsers are fine, but what e.g. about mobile apps? (Should I better split this off into a separate SF question?) [/edit]

psmears
  • 330
  • 1
  • 6
Nils Toedtmann
  • 3,202
  • 5
  • 25
  • 36
  • Firefox for example sends a lowercase `Host` header (at least that's what its developer tools are showing me) so assuming all browsers do this, you shouldn't have any issue even if some equipment on the path to the server doesn't like a mixed case hostname. `curl` on the other hand, preserves the case when sending the header. –  Mar 04 '15 at 15:27

1 Answers1

25

Yes, the hostname really is case-insensitive, as specified in RFC 3986 § 3.2.2, because hostnames in general are case-insensitive in the DNS. This RFC also gives recommendations on how to avoid the problems you mentioned:

Although host is case-insensitive, producers and normalizers should use lowercase for registered names and hexadecimal addresses for the sake of uniformity, while only using uppercase letters for percent-encodings.

I have seen at least one HTTP cache (W3 Total Cache) which does not normalize the hostname in this manner, and ends up caching content multiple times, e.g. under example.com, Example.Com, EXAMPLE.COM, etc.

Community
  • 1
Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
  • 1
    At least as long as the worst that happens is that content gets cached multiple times by nonconformant caches, that seems like something one can live with. – user Mar 05 '15 at 10:44