Allow embedding in internationalized domain

Currently Discourse does not allow to configure a host that has non-Latin letters in its name for embedding. Any attempt to add a internationalized domain name (IDN) host for embedding results in “Host is invalid” error.

An IDN https://अमरकोश.भारत will have corresponding punycode as https://xn--l1b6a9di5a0j.xn--h2brj9c but neither of them qualifies as a valid host.

For now only solution seems to be to disable the property “content security policy frame ancestors - Restrict who can embed this site in iframes via CSP. Control allowed hosts on Embedding” to make it work. But that makes the discourse installtion open for embedding by anyone.

The host name validation for embedding should be relaxed to include internationalized domain name as well.

1 Like