When the robustness principle meets the tragedy of the commons, good people get driven to the brink of madness.<p>There are surely arguments for allowing any old garbage in URLs&#x2F;URIs&#x2F;IRIs - hey, it&#x27;s easy and fun! - but, gee, it&#x27;s not like bunging an identifier through a URI escape function is going to triple the code base.<p>Compare that with the surface area for potential bugs in the parsing code which somehow didn&#x27;t account for several megabytes of whitespace embedded in a URL or multiple code pages in a single string or whatever zalgoesque horror is showing up on the security bulletins this week. It&#x27;s a lot easier to proof code that only needs to deal with a strict subset of 7-bit clean ASCII and can politely decline embedded emojis.<p>When one web client starts being overly zealous in what it accepts, that puts an implicit onus on everybody else to start accepting that too (&quot;all browsers do&quot;!). Where would you draw the line? Well, we&#x27;ve got a couple of RFCs lying around, how about we go with those.<p>This stuff doesn&#x27;t have to be hard. Surely the act of issuing an HTTP redirect isn&#x27;t the Last Great Unsolved Problem of web engineering! I say rejoice in the beauty of URIs in canonical form. Be miserly in what you accept for a change.