Redirect and credential URLs

[youennf]

I investigated how much redirect URLS with credentials are interoperable, and here is my current understanding of the landscape here based on web-platform-tests/wpt#8976:

• Firefox is following the spec (error if cors mode and load is cross origin)
• Safari is stripping any credentials from a redirect URL
• Chrome is erroring redirect URLs containing credentials following https://www.chromestatus.com/feature/5669008342777856.
  (not tested on Edge)
  3 browsers, 3 different behaviors, can we try to converge here?
  I was hoping WebKit could be aligned with the spec.
  It would be good to know the rationale behind Chrome behavior.
  Maybe the spec should be updated accordingly.

[wanderview]

Just to clarify, is this talking about URL foo@bar style credentials or Request.credentials property?

[youennf]

This is about URL foo@bar credentials

[annevk]

Note that this is under discussion in #465 (I even pinged you!). Somewhat surprising the chromestatus.com entry doesn't mention that.

[annevk]

cc @mikewest

[youennf]

Oh, did not remember that issue. Let's continue it in #465