empty auth vs no auth -- same?

[stevenvachon]

http://:@domain/ (empty username and password)
vs
http://domain/

Are they the same?

[annevk]

@stevenvachon the former sets the password to the empty string. Which means it serializes differently. What's the context for the question?

[stevenvachon]

Do all clients treat the above two URLs as the same, or do they use the empty username/password values?

If they are the same, should they not serialize the same? Just as these two do:

http://domain/?va r=va+lue

http://domain/?va%20r=va lue

I'm writing a library that, among other things, provides a means of comparing URLs for relation.

[stevenvachon]

With the current public API of this standard, having no username and password is the same as having an empty username and password.

url = new URL("http://domain.com/")
url.username==="" && url.password===""  //-> true

url = new URL("http://:@domain.com/")
url.username==="" && url.password===""  //-> true

[annevk]

Yeah, the API does not distinquish there. We could maybe also normalize the serialization, but that would require impl changes.

[domenic]

We could maybe also normalize the serialization, but that would require impl changes.

Hmm, would it? Assuming new URL("http://:@domain.com/").href is the correct test, that yields:

• Firefox: TypeError
• Chrome: "http://domain.com/"
• Edge: Error

[annevk]

Thanks for checking. It does seem like the standard is bogus.