Re: [art] Putting actual credentials in URIs was an accident of history, let's repurpose those fields instead?

[[e-mail]]

"Soni L." <[e-mail]> writes:
> So how bad of an idea would it be to repurpose "username" and "password" 
> in URIs for all sorts of stuff? E.g. 
> https://soniex2.tumblr.com/post/705832532473724928/so-heres-our-plan-we-wanna-have-web-git-urls
>
> ---
>
> so here’s our plan: we wanna have web+git URLs, and it should look like 
> web+git://username:namespace@hostname/path
>
> so for example, on something like github, username = the username of the 
> owner of the repo, namespace = always empty since github doesn’t support 
> namespaces, hostname = github.com, path = repo name.

The current standard is RFC 3986, which says in section 3.2.1:

   The userinfo subcomponent may consist of a user name and, optionally,
   scheme-specific information about how to gain authorization to access
   the resource.  [...]
   Use of the format "user:password" in the userinfo field is
   deprecated.

If I read it correctly, "user@" is considered fine but adding
":password" is not.

But it's clear that there's no firm definition of what "password" is or
does, other than it should be kept secret.  E.g.

   Applications should not render as clear text any data
   after the first colon (":") character found within a userinfo
   subcomponent unless the data after the colon is the empty string
   (indicating no password).

Personally, I would move the namespace information to the first
component of the path, which is a place that has the right semantics.
That is, I'd change your example to

    web+git://username@hostname/namespace/path

Indeed, "username" is generally used to designate *what user you are
acting as while accessing the data* not an identifier of what user owns
the data.  So if "username = the username of the owner of the repo",
your semantics are better aligned to use

    web+git://hostname/username/namespace/path

or perhaps

    web+git://hostname/~username/namespace/path

Dale