isUrl() validator rejects localhost URLs about validator.js

[chriso]

Not sure how to proceed with this one. It's trivial to remove the TLD restriction but then the validator lets about anything through. A different alternative is to just whitelist localhost. Suggestions?

[lmorchard]

I'd say letting anything through is fine. They're still valid URLs, not all host names have TLDs. The only way you can really tell is to check to see if DNS resolves and if the host is reachable, but no one wants to do that.

[foxbunny]

+1 to white-listing only localhost.

For use on LANs and similar applications where you don't have a TLD, you can use different techniques, which are faster, like supply a list of valid hostnames from a central location (DNS server?), and check only the paths without domain name, port, etc.

Localhost is the only notable exception since we use it for development, although I usually use a domain name like d1.localhost.tld myself just to avoid cases like this.

[drewish]

I frequently have short hostnames that I use for test sites. I think it'd be better to be lenient here and let people that need to verify host names do so in subsequent steps. I think checking for a scheme and target should be sufficient.

[chriso]

I agree with you on most counts but I'm not game to let an arbitrary alphanumeric string pass through the validator. It's trivial to modify your hostnames to include a tld