Should we block bad ports?

[andreubotella]

https://fetch.spec.whatwg.org/#port-blocking

Those ports are usually for services other than HTTP, and you usually won't have HTTP servers on those. They're probably blocked to prevent sending an HTTP request that might be parsed as a different protocol.

In browsers there's also the concern that this port blocking might be used to prevent remote websites messing with local network services. There are other mechanisms to prevent this for HTTP requests, but they might not work in the case of an attacker-controlled HTTP request being parsed as some other protocol. In that case, this probably isn't a concern that applies to servers, but it might apply to CLI processes (e.g. Node or Deno applications) running in a computer.