Q: Should there be an option to whitelist certain urls/hostnames?

[jrochkind]

To avoid user-submitted data being able to download from any arbitrary url?

[janko]

Yeah, that would be useful.

For example, when using shrine-tus you'll almost certainly want to allow only URLs from the tus server that you're using. So if support for host whitelisting gets added here, shrine-tus will benefit from that as well.

[janko]

I thought about this again, I think whitelisting functionality belongs outside of shrine-url. Since it's possible to validate the URL before assigning it as the attachment, there is no need to provide additional validation mechanism inside shrine-url.