@hongminhee@hollo.social · Reply to Emelia 👸🏻

@thisismissem @by_caballero @cocoa_vrc Here's the translation:

According to Section 4 (“Definition”) of RFC 7565, which defines the acct URI scheme:

If an application needs to compare two 'acct' URIs (e.g., for purposes of authentication and authorization), it MUST do so using case normalization and percent-encoding normalization as specified in Sections 6.2.2.1 and 6.2.2.2 of RFC 3986.

This leads us to examine Section 6.2.2.1 (“Case Normalization”) of RFC 3986, which states (the emphasis is mine):

When a URI uses components of the generic syntax, the component syntax equivalence rules always apply; namely, that the scheme and host are case-insensitive and therefore should be normalized to lowercase. For example, the URI HTTP://www.EXAMPLE.com/ is equivalent to http://www.example.com/. The other generic syntax components are assumed to be case-sensitive unless specifically defined otherwise by the scheme.

Therefore:

  1. For acct: URIs:

    • The scheme part (acct:) is case-insensitive
    • The host part (after @) is case-insensitive
    • The userpart (before @) is case-sensitive, as RFC 7565 does not specify otherwise
  2. This means that:

    • acct:FOO@example.com and acct:foo@example.com are different URIs
    • acct:user@EXAMPLE.COM and acct:user@example.com are equivalent
    • ACCT:user@example.com and acct:user@example.com are equivalent

This interpretation follows directly from the combination of the normalization requirements in RFC 7565 and the case sensitivity rules defined in RFC 3986.

datatracker.ietf.org

RFC 3986: Uniform Resource Identifier (URI): Generic Syntax

A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form, along with guidelines and security considerations for the use of URIs on the Internet. The URI syntax defines a grammar that is a superset of all valid URIs, allowing an implementation to parse the common components of a URI reference without knowing the scheme-specific requirements of every possible identifier. This specification does not define a generative grammar for URIs; that task is performed by the individual specifications of each URI scheme. [STANDARDS-TRACK]

1 reply

@julian@fietkau.social · Reply to 洪 民憙 (Hong Minhee) :nonbinary:

@hongminhee @thisismissem @by_caballero @cocoa_vrc

Last time I looked into it, opinions were split. My own conclusion was identical to @hongminhee's, but I've seen arguments in the opposite direction based on other specs (I have sadly forgotten which ones).

I think the current gold standard is to preserve and respect username capitalization as given by the origin server, and not trying to normalize username case.

Misskey used to force acct: URIs to lower case. I wonder if it still does that.