Re: [fetch] URLs with username/password (#26)

Right, I think the same applies to a page using `XMLHttpRequest` right now. The reason I added the restriction was that I thought we wanted to move away from such URLs so I figured I should restrict them here even though they can end up in `Request` objects in other ways.

There's other such cases. E.g. the only way to get a cross-origin referrer in a `Request` object is through a cross-origin "cors" stylesheet.

I don't think either is problematic personally, but I'm happy to make changes here obviously provided the argument is somewhat compelling.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/26#issuecomment-137654825

Received on Friday, 4 September 2015 05:55:51 UTC