[whatwg] Question about document.referrer (and document.URL, document.location.href) when IDN domains are in use

[Boris Zbarsky]

On 7/12/13 2:15 PM, Ian Hickson wrote:
> What's not useful about the way it's defined? It's set to a specific
> string.

I couldn't find where it was normatively set to anything.

>> In cases when the hostname is non-ASCII, the Referer header will have it
>> encoded in punycode.
>
> Is that defined anywhere?

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.36 which 
defines it syntactically as a URI, which means that if you have an IRI 
you have to convert it to an IRI before putting it in there.

> That's correct per spec (assuming the punycoding is required anywhere).
> The latter two are set separately than document.referrer:
>
>     http://whatwg.org/html/#set-the-document's-address

The thing is, people are comparing origins from postMessage to origins 
from document.referrer.  See 
<https://bugzilla.mozilla.org/show_bug.cgi?id=852796#c6>.  Also see 
<https://bugzilla.mozilla.org/show_bug.cgi?id=720331>.

Also, as a note, nothing above makes it particularly clear that "the URL 
that was originally to be fetched" is not already punycode...  Ah, well.

> If other browsers don't match this, file bugs on them. :-)

<shrug>.  It probably won't do much good, but:

http://code.google.com/p/chromium/issues/detail?id=259920&thanks=259920&ts=1373653828

https://bugs.webkit.org/show_bug.cgi?id=118611

-Boris