Only allow HTTP URLs by default

[callumlocke]

isAbsoluteUrl('javascript:throw%20document.cookie') // true

Although this might be technically correct (?), it seems like it's not what most people would think of as an absolute URL, and it could lead to a false sense of security that the input has been validated as a 'real' URL.

Possible solutions:

• Release a new major version that ensures the protocol is http or https
  • Maybe with an option like { allowNonHttp: true } for people who want the old behaviour.
• Or just add a warning in the readme that this will return true for any protocol, even javascript:.

[sindresorhus]

This package is really not meant as a security measure and javascript: is technically an absolute URL. However, I also guess the main use-case is to check HTTP URLs, so I'm willing to change the default behavior. How about an option called httpOnly which defaults to true?

Or just add a warning in the readme that this will return true for any protocol, even javascript:.

We can do this too for in case the user set httpOnly to false.

---

If anyone wants to work on this, see the feedback in #14 and #12.