From: mathew <meta@...>
Date: 2010-09-27T10:44:44+09:00
Subject: [ruby-core:32575] Re: [Ruby-Feature#3848][Open] Using http basic authentication for FTP with Open URI

On Sat, Sep 18, 2010 at 13:19, James Edward Gray II
<james@graysoftinc.com> wrote:
> OpenURI is just a wrapper around some clever URI parsing and URI seems to support it just fine:
>
>>> require "uri"
> => true
>>> u = URI.parse("http://user:pass@server.com/")
> => #<URI::HTTP:0x1007180f8 URL:http://user:pass@server.com/>
>>> u.userinfo
> => "user:pass"
>>> u.host
> => "server.com"

I feel obliged to point out that this is deprecated by the current
generic URI RFC.

RFC3986 section 3.2.1: 'Use of the format "user:password" in the
userinfo field is deprecated.'

RFC2396 stated that it was "NOT RECOMMENDED".

RFC1738 didn't allow it at all.

So building systems which store and process username and password in
this way is a bad idea.


mathew
-- 
<URL:http://www.pobox.com/~meta/>