authenticated URL spaces vs PRISM vs NSA

Escaping username characters in basic auth URLs

When using http basic authentication, the username can be passed in the URL, e.g. http://david@foo.com/path/ But now suppose the username is an email address, e.g. david@company.com. Doing this is clearly ambiguous: http://david@company.com@foo.com/path/ Is there a way to escape the @ character in the username? I tried standard URL encoding: http://david%40company.com@foo.com/path/ But that didn't do it. http http-basic-authentication shareimprove this question asked Jul 16 '11 at 15:50 David Ebbo 24.5k34167

You can't use @ in URLs. Or did I got you wrong? – Hnatt Jul 16 '11 at 15:53 add a comment

1 Answer

activeoldestvotes

Não encontrou uma resposta? Pergunte em Stack Overflow em Português.

✕

up vote42down voteaccepted

According to RFC 3986, section 3.2.1, it needs to be percent encoded: userinfo = *( unreserved / pct-encoded / sub-delims / ":" ) So it looks like http://david%40company.com@foo.com/path/ Is right. Where are you trying to read it? Maybe you need to manually decode the value? shareimprove this answer answered Jul 16 '11 at 16:03 sagi 4,1872128

I have my own server side code that processes the credentials. I need to debug it and see exactly what I receive when I escape this way. I'll follow up! – David Ebbo Jul 16 '11 at 16:27 2   Clients don't appear to do well with that syntax. e.g. IE9 blocks it before even sending any request, and gives the error "Windows cannot find 'david%40company.com@foo.com/path/';. Check the spelling and try again.". This leads me to believe that this syntax is not actually supported, despite what it may seem from the RFC. – David Ebbo Jul 17 '11 at 5:15  Works fine using curl... – Matthew Gilliard Nov 25 '15 at 16:43 Interesting. We tried this exact syntax with a URL being fetched using Drupal's drupal_http_request, and it didn't let the user login. (We have since fixed the problem, but I came searching anyway out of academic interest.) – Trejkaz Jan 23 at 2:15  http://stackoverflow.com/questions/6718471/escaping-username-characters-in-basic-auth-urls