To what extent are public suffix handles disallowed?

[DavidBuchanan314]

I'm a bit confused, since #969 ("Do not allow publicsuffix domains as handles") is closed as completed, and https://bsky-debug.app/handle?handle=retr0-id.translate.goog says "Invalid DNS name (publicsuffix or non-ICANN domain?)". Fair enough, but domains like ".co.uk" are also public-suffix domains, but they seem to be allowed.

Where can I find the logic behind this? I can't seem to find the code that actually implements PSL checking - or specs/docs that describe it.

[DavidBuchanan314]

While investigating this I noticed that the HTTP resolver seemingly doesn't deal with trailing whitespace properly - https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=www.da.vidbuchanan.co.uk

This results in an "The server gave an invalid response and may be out of date." error in the bsky.app web UI if there's a trailing newline, even if the did is valid.

Edit: looks like this is fixed by #1299, which isn't merged yet

[bnewbold]

My understanding (@dholms chime in if i've missed something) is that we don't disallow public suffix handles. The (partial) resolution to the earlier domain cleverness was to use the /.well-known/... path instead of an /xrpc/... path. I can see how the closing of #969 was confusing on this point.

bsky-debug.app seems to be using custom code, i'll look in to that.

Just finally merged the #1299 you linked, could be a while until it gets deployed.

Two recent other handle things:

• we accidentally allowed in some Handshake domain handles in main, because of a fallback DNS provider that happens to support them. we generally hold the line that handles should have boring old regular DNS TLDs
• the .alt TLD was recently approved by the IETF as a special case. we'll disallow that for now (still need to update spec and code)