[fetch] URLs with username/password (#26)

When execute fetch() on origin http://a.com, the spec seems to allow us to fetch or redirect to a URL with username/password, if the all URLs in the redirect chain before that URL are on the origin http://a.com.
Particularly, if other conditions are OK (e.g. Access-Control-Allow-Origin is properly set),
fetch('http://user:pass@a.com/', {mode: 'cors'}): OK
fetch('http://user:pass@b.com/', {mode: 'cors'}): OK
fetch('http://a.com/', {mode: 'cors'}), which is redirected to http://user:pass@a.com/: OK
fetch('http://a.com/', {mode: 'cors'}), which is redirected to http://user:pass@b.com/: OK
fetch('http://b.com/', {mode: 'cors'}), which is redirected to http://user:pass@a.com/: Network Error
fetch('http://b.com/', {mode: 'cors'}), which is redirected to http://user:pass@b.com/: Network Error

Is my understanding is correct and is this behavior intentional?
(e.g. the spec doesn't intend to reject all cross-origin requests/redirects to URLs with username/password, right?)


---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/26