[whatwg/xhr] The logic in the WPT send-authentication-competing-names-passwords.htm does not match the spec. (#191)

According to open():

>9. If parsedURL’s host is non-null, run these substeps:
>     If the username argument is not null, set the username given parsedURL and username.
>     If the password argument is not null, set the password given parsedURL and password.

However, the test is doing something more involved:

>// if user2 is set, winning user name and password is 2
>if(user2)
>  userwin = user2, passwin = pass2
>// if user1 is set, and user2 is not set, user1 and pass1 win
>if(user1 && ! user2)
>  userwin = user1, passwin = pass1
>// if neither user name is set, pass 2 wins (there will be no userinfo in URL)
>if (!(user1 || user2))
>  passwin = pass2

Firefox passes the test as-is, Chrome does what the spec states. Edge and Safari seem to be doing their own thing.

I'm not sure if it's better to update the spec to match Firefox or to change the tests, but if it's the latter then that block of logic in the test should be removed, and userwin and userpass should be set simply to:

>let userwin = user2 || user1;
>let passwin = pass2 || pass1;


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/xhr/issues/191