Product features · Restricted HTTPS origin comparison

import re
from urllib.parse import urlsplit

def https_origin(url):
    if type(url) is not str or any(not 33 <= ord(c) <= 126 for c in url):
        raise ValueError("origin.text")
    p = urlsplit(url)
    if p.scheme.lower() != "https" or p.username is not None or p.password is not None:
        raise ValueError("origin.scheme")
    host = p.hostname or ""
    labels = host.lower().split(".")
    if len(labels) < 2 or not re.fullmatch(r"[a-z]{2,63}", labels[-1]):
        raise ValueError("origin.dns")
    if any(not re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", x) for x in labels):
        raise ValueError("origin.label")
    if len(host) > 253 or p.netloc.endswith(":") or "\\" in url:
        raise ValueError("origin.authority")
    port = p.port if p.port is not None else 443
    if not 1 <= port <= 65535:
        raise ValueError("origin.port")
    return ("https", host.lower(), port)

def same_origin(a, b):
    return https_origin(a) == https_origin(b)