Link to the issue for other users who, like me, were concerned by your post:
https://github.com/mholt/caddy/issues/1632
According to the author, the issue is that (a) there are two RFCs that contradict each other on this distinction, and (b) most browsers do not treat them as such for the purpose of their same-origin policies. So he thinks it's best not to enable this alternate URL by default since it's trivial to add it as another route if you want.
I don't know if he's right or wrong, nevertheless, this clearly isn't a dude that doesn't give a shit.
Also, the concerns over security the caddy developer make aren't clarified and probably don't exist.
No dot has 2 possible meanins and with dot has one _to the resolving application_. To the server resolving a virtual host there is only one for both.
The quote is:
"RFC 1034 says the two domains are the same, but RFC 3986 says they are not. I can't tell from the http spec whether the two Host values are equivalent or not."
> The rightmost domain label of a fully qualified domain name in DNS may be followed by a single "." and should be if it is necessary to distinguish between the complete domain name and some local domain.
When there is no ambiguity then they mean the same thing.
Anyway, as a sibling comment said, it's not a good rfc to use for this purpose.
Besides, it was deprecated by the WHATWG URL spec anyway, which does use the same equality rules as RFC 1034 (after normalization)
Specifically, the DNS RFCs define that, given no search domain, a relative hostname (e.g. google.com) is equivalent to its absolute hostname form (e.g. google.com.).
This is used in SSL validation as well, a certificate valid for one is valid for the other, and in reverse.
Every webserver SHOULD respond to both names identically, or redirect from one to the other.
Let's try that. https://news.ycombinator.com./ yup, works. https://www.nginx.com./ as well. In fact, nginx, Apache2, IIS, the Google Cloud load balancers, AWS's load balancers, every major site supports this.
The only http servers breaking the RFC for absolutely no reason are Caddy and Traefik.
And the issue has been closed as WONTFIX months ago.
Do you really want to use an http server that doesn't even consider following the RFCs? And pay for that?