Thomas Wisniewski Assignee
	Description • 8 years ago

In bug 933759, the XHR Open() methods were changed to better-match with the WebIDL in the spec, but there is still follow-up work to do:

1) Fold these two methods into one, removing their use of Optionals:
>void Open(const nsACString& aMethod, const nsAString& aUrl, bool aAsync, const nsAString& aUsername, const nsAString& aPassword, ErrorResult& aRv);
>nsresult Open(const nsACString& aMethod, const nsACString& aUrl, const Optional<bool>& aAsync, const Optional<nsAString>& aUsername, const Optional<nsAString>& aPassword);

2) Correct the handling of username and password to better match steps 7 and 8 in the spec.

Here is a patch which does these things. A try run seems fine: https://treeherder.mozilla.org/#/jobs?repo=try&revision=b74d9cc3a3b4

Unfortunately, I can't think of a way to add web platform tests to ensure that #2 doesn't break, because Firefox and Chrome both disallow URL authentication even in XHRs (and I'd be surprised if WebKit or Edge allow it).

I'm also not sure if it's even worth changing the spec at this point to use header-based authentication instead, even if the feature is technically broken anyway in modern browsers (at least without preference-flipping).