Drop support for embedded credentials in subresource requests.

Category: Network / Connectivity
Type: New or changed feature
Status: Removed (Chrome 59)
Intent stage: None

Breaking change: No
Enterprise impact: None
Spec maturity: Pre-incubation

Summary

We should block requests for subresources that contain embedded credentials (e.g. "http://ima_user:hunter2@example.com/yay.tiff"). Such resources would be handled as network errors.

Standards & signals

Specification: https://github.com/whatwg/fetch/pull/465
Firefox: No signal
Safari: No signal
Web developers: No signals
Tracking bug: https://crbug.com/435547

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=drop-support-for-embedded-credentials-in-subresource-requests
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Drop%20support%20for%20embedded%20credentials%20in%20subresource%20requests.
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Drop%20support%20for%20embedded%20credentials%20in%20subresource%20requests.
Baseline status: https://webstatus.dev/?q=Drop%20support%20for%20embedded%20credentials%20in%20subresource%20requests.

View on chromestatus.com