Basic authentication URL not recognized

I'm doing testing on an internal application that support basic HTTP authentication. Ignore the security concerns for the minute.


My problem is that Safari won't recognize a URL in the format

http://<user>:<password>@example.com/

Instead I get an error page stating

Safari can’t open user:password@example.com" because OS X doesn’t recognize Internet addresses starting with “user:”.


I am explicitly stating http:// at the start of the URL (some of my URLs have a custom port number, but this happens on default 80 as well), I have tried the formats http://<user>@example.com, http://<user>:<password>@example.com, and even http://:@example.com/. Every time Safari complains of an invalid URL. These all work in Chrome.


Safari will support this format if I use https://<user>:<password>@example.com, however the application I am testing (3rd party) doesn't support https, so the query hangs.


Then it gets stranger still. We have a web page with a hyperlink in the format http://<user>:<password>@example.com/. This hyperlink opens in a new page and works (I get a phishing warning, but that's a separate issue). But if I copy the link target, and paste it into a new page it fails.


I am using Safari Version 8.0.6 (10600.6.3).


Is there some option somewhere to enable HTTP auth URLs (given it works for HTTPS)? Is this a bug?

Or is this intentional behaviour on the part of Safari not to allow HTTP auth? In which case, is it a bug that it works for a hyperlink, but not a manually entered URL?


Edit: If anyone has any tips about how to prevent auto-formatting of URLs that would be great too. I can't seem to prevent them all being turned into hyperlinks.

iMac, OS X Yosemite (10.10.3), Safari Version 8.0.6 (10600.6.3)

Posted on Sep 21, 2015 7:33 PM

Reply
Question marked as Top-ranking reply

Posted on Sep 22, 2015 9:53 AM

Safari will not send passwords in the clear. You'll have to use another browser that supports that behavior, if there is one.

3 replies

Sep 22, 2015 4:06 PM in response to Linc Davis

It will send passwords in the clear if I click a hyperlink, just not if I type in the URL.


Is there any evidence that this is intended behaviour? The fact it gives an error stating "not recognised" instead of an error "not supported" is misleading. I know it "recognises" the URL when I preface it with HTTPS.


The only other browser I have tried this with so far is Chrome, and that supports it. So I am now forced to use Chrome.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Basic authentication URL not recognized

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.