Eli ben Ya'acov said in news:
[email protected]:
After I logon to a site using the form
http://username:[email protected], the
username
assword is disappear from the address bar, and
only the
http://www.sitename.com remains?
Why is that? Is there a way to change it? (I know it
doesn't happen is Mozilla)
The username and password was never legal HTTP syntax according to RFC
1738.
The generic URL syntax is just that: generic. It does include the user
information fields. However, subsequent sections describing each URL
scheme will override that generic URL with the requirements within that
scheme. The HTTP scheme does *not* permit user information in its URL.
The FTP scheme does allow user information.
A security update is available that modifies the default behavior
of Internet Explorer for handling user information in HTTP and in
HTTPS URLs
http://support.microsoft.com/?id=834489
The following is an excerpt from "Uniform Resource Locators (URL)", RFC
1738 (
http://www.ietf.org/rfc/rfc1738.txt):
3.3. HTTP
The HTTP URL scheme is used to designate Internet resources
accessible using HTTP (HyperText Transfer Protocol).
The HTTP protocol is specified elsewhere. This specification only
describes the syntax of HTTP URLs.
An HTTP URL takes the form:
http://<host>:<port>/<path>?<searchpart>
where <host> and <port> are as described in Section 3.1. If :<port>
is omitted, the port defaults to 80. No user name or password is
allowed. <path> is an HTTP selector, and <searchpart> is a query
string. The <path> is optional, as is the <searchpart> and its
preceding "?". If neither <path> nor <searchpart> is present, the
"/" may also be omitted.
Note that it specifically states "No user name or password is allowed",
nor does it show those fields in the syntax for an HTTP schemed URL.
The problem seems to have stemmed from users (and implementers) that saw
the generic URL scheme described in section 3.1 and thought it was
applicable across all schemes without regard to the amendments made by
the subsequent sections to define those schemes. The generic or common
syntax is:
//<user>:<password>@<host>:<port>/<url-path>
Each scheme can obviate or alter this scheme. So Microsoft Internet
Explorer got updated to be compliant with the RFC defining the Internet
standard. Mozilla and others are non-compliant with the standards
established by RFC regarding this issue and have probably chosen to
remain non-compliant to follow the de facto usage of user information in
an HTTP schemed URL due to its historical misuse.
