{"id":"f58454e956b69cd8cd111abf8f5cbb67f7e7931a1dcb6a961f763c54df49bc99","pubkey":"b22b06b051fd5232966a9344a634d956c3dc33a7f5ecdcad9ed11ddc4120a7f2","created_at":1786557243,"kind":30817,"tags":[["d","trusted-domains"],["title","Trusted Domains"],["alt","Nostr Implementation Possibility: Trusted Domains"],["k","36205","Generic Lists"],["client","NostrHub"]],"content":"NIP Trusted Domains\n\n## Abstract\n\nMany apps and websites display security warnings (e.g., \"Are you sure you want to open this link?\") when users click on external links. While this is an important security measure to protect against phishing and malicious websites, it can become a repetitive and frustrating experience for links or domains that the user trusts and visits frequently.\n\nThis NIP defines a list that allows users to keep their trusted domains synchronized. Nostr clients can read this list and bypass security warnings when the user clicks on a link that matches an entry in the list.\n\n## Event Definition\n\nThis list is a generic list named `trusted-domains`. \n\nUsers MAY publish this event to store their trusted domains. \n\n### Tags\n\nThe event uses the following tags to define trusted destinations:\n\n`[\"domain\", \"<domain-name>\"]`: Specifies an exact trusted domain. Only links where the hostname EXACTLY matches this value SHOULD be considered trusted. Subdomains are NOT automatically trusted.\n\nExample: `[\"domain\", \"nostr.build\"]` only trusts `nostr.build`. If a user also wants to trust its image CDN, they MUST add a separate `[\"domain\", \"image.nostr.build\"]` tag.\n\n\n### Example Event\n\n```json\n{\n  \"kind\": 36205,\n  \"pubkey\": \"...\",\n  \"created_at\": 1678901234,\n  \"tags\": [\n    [\"d\", \"trusted-domains\"],\n    [\"domain\", \"nostr.build\"],\n    [\"domain\", \"github.com\"]\n  ],\n  \"content\": \"\",\n  \"id\": \"...\",\n  \"sig\": \"...\"\n}\n```\n\n## Client Behavior\n\n1. **Fetching**: Clients SHOULD fetch the user's `trusted-domains` list upon login or startup to cache it.\n2. **Link Handling**: When a user clicks an external link:\n   - The client MUST check if the link's hostname EXACTLY matches any `domain` tag in the trusted list.\n   - If a match is found, the client SHOULD open the link immediately without displaying a confirmation popup.\n   - If no match is found, the client SHOULD display its standard security warning or confirmation dialog.\n3. **Adding to the List**: When displaying a security warning for an untrusted link, clients SHOULD provide an option (e.g., a checkbox or button: \"Always trust this domain\") to add the domain to the user's `trusted-domains` list and publish the updated event.","sig":"4f82da4eb23bdaf70f2ef5ae6e0ec49fa82f4db450e6534be51aae16bfbe7a399c682d2a9219ecd904b0986147263cd8622cfb7178907da630acb8b8fd892a6e"}