the scheme check in origin() is what stops javascript: and mailto: links, since urljoin passes them through unchanged. the explicit .lower() on the hostname can go, because SplitResult.hostname is already lowercase. A unicode host like exámple.com gets refused against the ASCII allowlist, which is a bit inconvenient but safe. encoding it with IDNA before comparing would fix that ;)