diff --git a/doc/api/url.md b/doc/api/url.md index 06b80a438ad748..53aec1f6596985 100644 --- a/doc/api/url.md +++ b/doc/api/url.md @@ -1244,6 +1244,12 @@ A `TypeError` is thrown if `urlString` is not a string. A `URIError` is thrown if the `auth` property is present but cannot be decoded. +Use of the legacy `url.parse()` method is discouraged. Users should +use the WHATWG `URL` API. Because the `url.parse()` method uses a +lenient, non-standard algorithm for parsing URL strings, security +issues can be introduced. Specifically, issues with [host name spoofing][] and +incorrect handling of usernames and passwords have been identified. + ### `url.resolve(from, to)`