From: mathew murphy Date: 2010-11-25T10:46:17+09:00 Subject: [ruby-core:33342] [Ruby 1.9-Feature#4071] support basic auth for Net::HTTP.get requests Issue #4071 has been updated by mathew murphy. Something I'd like to point out: * RFC 1738 did not allow username and password in HTTP URLs at all; see section 3.3. * RFC 2396 said: > Some URL schemes use the format "user:password" in the userinfo field. > This practice is NOT RECOMMENDED, because the passing of authentication > information in clear text (such as URI) has proven to be a security risk > in almost every case where it has been used. RFC 2396 did not, however, state that HTTP was one of the schemes that used that information. Nor did it include the addition of username and password information to http URLs in section G3, which listed the modifications to RFC1738. So in fact, username and password in HTTP URLs *was never standard* as per the RFCs. ---------------------------------------- http://redmine.ruby-lang.org/issues/show/4071 ---------------------------------------- http://redmine.ruby-lang.org