Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
Microsoft are releasing an IE update which will change the way HTTP and HTTPS URLs are handled.
They are dropping the support for “http://user:password@www.acme.com” to pass basic authentication data. This applies to URLs typed in the address bar, links and programs/scripts that use the IE APIs.
Once patched a URL with this form will cause a syntax error.
The HTTP URL standards do not allow for the HTTP[S]://username:password@www.website.com:port syntax. Therefore, Microsoft (and Netscape/Mozilla) are making their browsers standard-compliant, whereas before they were not. Opera is already standards-compliant as they do not allow these types of URLs. See for example http://seclists.org/lists/fulldisclosure/2003/Dec/0478.html and RFC2396/RFC2616.
_________________________
There are two types of vessels, submarines and targets.
