title: Why do browsers not send the Authentication header when the credentials are provided in the URL?
body: <p>I would like to give users the opportunity to do a per-request-authentication by providing the username and password in the URL. As the request is secure, I have no concerns on that.</p>
  
  <p>I tried to call the request <code>http://user:password@localhost/</code> using a usual browser, (Firefox, Chrome, Safari and Opera was the ones I tested) and I got a 401 response back. When I tried the same URI, but this time provided the credentials as HTTP-header like <code>Authentication: Basic dXNlcjpwYXNzd29yZA==</code>, it worked.</p>
  
  <p>When searching for that, I found this answer to another question: <a href="https://serverfault.com/questions/371907/can-you-pass-user-pass-for-http-basic-authentication-in-url-parameters#answer-371918">https://serverfault.com/questions/371907/can-you-pass-user-pass-for-http-basic-authentication-in-url-parameters#answer-371918</a></p>
  
  <p>This answer claims, that the browser should automatically generate the Authentication header out of the credentials provided in the URL.</p>
  
  <p>When trying it on the command line using curl, it works. So, why doesn't it work in the browser?</p>
  
  <p>Has this something to do with security?</p>
  
  <p>Firefox is the only one claiming:</p>
  
  <blockquote>
    <p>You are about to log in to the site "localhost" with the username "user", but the website does not require authentication. This may be
    an attempt to trick you.</p>
    
    <p>Is "localhost" the site you want to visit?</p>
  </blockquote>
  
  <p>But when confirming this request by clicking on yes, it sends the request without credentials. At least, I can't see them in the network-tab of firebug ... and the response is a 401, too.</p>