Re: [fetch] URLs with username/password (#26)

> fetch() runs the Constructor algorithm

But if you pass a `Request` to `fetch()` the associated __request__ is passed as _input_, not a string. So in step 12 the substeps are not run. The URL buried inside makes it through unscathed.

Same thing applies to `Cache.add()` - the passed `Request`'s (API) associated __request__ (concept) is what gets used, and it's not rejected based on credentials.



---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/26#issuecomment-137595602