# "Host is invalid" error when TLD is longer than 7 characters

**URL:** https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081
**Category:** Bug
**Created:** [June 20, 2016, 7:13pm UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081 "2016-06-20T19:13:23Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![flimm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/flimm/32/121704_2.png) [@flimm](https://meta.discourse.org/u/flimm)
#### Post date: [June 20, 2016, 7:13pm UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/1 "2016-06-20T19:13:23Z")

</div>

When setting the allowed hosts for embedding, I get this error: `Host is invalid`.

This is because it is not passing this regex in the source code, line 26 in the source code of `embeddable_host.rb`: [Link](https://github.com/discourse/discourse/blob/648bcb6432ee1fbca0fc9d45c25c3d114f2a0892/app/models/embeddable_host.rb#L26)

```
def host_must_be_valid
  if host !~ /\A[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,7}(:[0-9]{1,5})?(\/.*)?\Z/i &&
     host !~ /\A(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\Z/
    errors.add(:host, I18n.t('errors.messages.invalid'))
  end
end

```

This regex only passes if the TLD is seven characters long or fewer. There are many TLDs that are longer than that nowadays, for instance:

- .cancerresearch
- .xn–y9a3aq
- .consulting

The fix should be fairly easy.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [June 20, 2016, 7:38pm UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/2 "2016-06-20T19:38:22Z")

</div>

> [@flimm](#):
>
> The fix should be fairly easy.

Then why don’t you submit a pull request? 😉

---

<div class="post-metadata">

### Author: ![flimm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/flimm/32/121704_2.png) [@flimm](https://meta.discourse.org/u/flimm)
#### Post date: [June 22, 2016, 9:02am UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/3 "2016-06-22T09:02:11Z")

</div>

> [@zogstrip](#):
>
> Then why don’t you submit a pull request? 😉

Because I haven’t decided what I think about CLAs in general or this one in particular. Also, I have not tested the fix. It should be fairly easy for someone who is fine with the CLA and who has already used to getting Discourse to build and to run tests.

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [June 22, 2016, 9:09pm UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/4 "2016-06-22T21:09:25Z")

</div>

Please post your easy changes and I’ll be happy to test it and contingent on the testing do a PR for you.

---

<div class="post-metadata">

### Author: ![flimm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/flimm/32/121704_2.png) [@flimm](https://meta.discourse.org/u/flimm)
#### Post date: [June 22, 2016, 9:27pm UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/5 "2016-06-22T21:27:17Z")

</div>

```
def host_must_be_valid
  if host !~ /\A[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,70}(:[0-9]{1,5})?(\/.*)?\Z/i &&
     host !~ /\A(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\Z/
    errors.add(:host, I18n.t('errors.messages.invalid'))
  end
end

```

There you go. I changed 7 to 70. I release my changes under the CC0 license by Creative Commons and under the public domain.

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [June 23, 2016, 12:34am UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/6 "2016-06-23T00:34:20Z")

</div>

Thanks. That does look like an exceedingly simple change.

From what I could find, the RFC allows up to 63 characters.  
Yet the longest approved I could find is 18 characters.

[http://data.iana.org/TLD/tlds-alpha-by-domain.txt](http://data.iana.org/TLD/tlds-alpha-by-domain.txt)

> travelersinsurance  
> northwesternmutual

A lot of code touches “host” and it is hoped that allowing more characters won’t break anything eg.  
an HTML element thats CSS doesn’t account for longer names.  
a database table field that might truncate or null longer names.  
other code that uses the value, eg. something like “reverse string position”

I made up a fake domain  
“kleinfeltersville.travelersinsurance”  
and it didn’t break the Admin → Settings → Onebox UI

But I could use your help in trying to embed a _real_ domain.

Please post the longest named example URL that passes [Iframely URL Debugger - Open Graph, Twitter Cards, oEmbed](http://iframely.com/debug) that you know of.

---

<div class="post-metadata">

### Author: ![flimm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/flimm/32/121704_2.png) [@flimm](https://meta.discourse.org/u/flimm)
#### Post date: [July 7, 2016, 7:15pm UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/7 "2016-07-07T19:15:59Z")

</div>

Here’s an example of a URL with a long TLD: [http://behold.photography/](http://behold.photography/)

---

<div class="post-metadata">

### Author: ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [July 8, 2016, 12:14am UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/8 "2016-07-08T00:14:02Z")

</div>

> [@flimm](#):
>
> There you go. I changed 7 to 70. I release my changes under the CC0 license by Creative Commons and under the public domain.

It does not pass the Armenian localized domain in the first post:

.xn–y9a3aq

I cannot find any active domains in that TLD however for iframely test. ICANN names a [Persian TLD and site: http://نمونہ.آزمایشی (http://xn–hhbbbh02d.xn–hgbk6aj7f53bba)](https://www.icann.org/news/blog/idn-wiki-adding-urdu-and-thai) which also does not appear to have actually be in use, but gives a more extreme example, and one presumably that should be supported.

My, from memory, understanding of the rules of DNS labels are:

All labels are 1 to 63 characters, case insensitive A to Z, 0 to 9 and - (hyphen), all from ASCII.  
No labels may start with a hyphen.  
No top level domain label may start with a number.

That means a regexp for a valid domain name would look like:

`/^([a-z0-9][a-z0-9-]{0,62}\.)+[a-z][a-z0-9-]{0,62}\.?$/`

Domains that are _just_ a TLD are sufficiently bizarre as to be worth ignoring.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 22, 2022, 12:52am UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/9 "2022-07-22T00:52:03Z")

</div>

Regex has evolved a fair bit since this was reported.

> <https://github.com/discourse/discourse/blob/8dad778fccd2facd63a96b061e6a5cbef219e70a/app/models/embeddable_host.rb#L68-L74>

I think this is resolved now?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 27, 2022, 12:52am UTC](https://meta.discourse.org/t/host-is-invalid-error-when-tld-is-longer-than-7-characters/46081/10 "2022-07-27T00:52:43Z")

</div>

This topic was automatically closed after 5 days. New replies are no longer allowed.
