Chrome 19 doesn't respect basic auth details embedded in the URL

Firefox might do a better job on this subject: it performs a HEAD request first, to see if the website actually requires authentication. If not, the user receives a warning to make the user aware of a potential phishing attack they might have been trapped into.

The userinfo component is supported according to the URI generic syntax, which FTP URIs follow, but HTTP URIs don't. See the sadly still not obsolete RFC1738: http://tools.ietf.org/html/rfc1738#section-3.1

I remember reading about Microsoft stopping supporting that option actually. The reasoning being that it could be used for sending users to malicious sites.

"malicious users can use this URL syntax together with other methods to create a link to a deceptive (spoofed) Web site that displays the URL to a legitimate Web site in the Status bar, Address bar, and Title bar of all versions of Internet Explorer."

I'm wondering if this was the reasoning for doing so in Chrome.

[1]: http://code.google.com/p/android/issues/detail?id=1353

Firefox warns users if they are authenticating to a site with a small message and asks them to confirm. This prevents pretty much all of the phishing attacks that people have been talking about without removing a potentially useful feature.

I would be curious to know who actually uses this type of auth in their browsers these days.

Usernames and passwords can be added to links to resources (and images) which aren't necessarily protected by authorization, and in that sense can be used as a "cookie" of sorts to track users irrespective of cookie settings. It's a bit hokey, but I've heard of it being done before (more than once, actually). Try it on your Web server, and dump the headers for your image request after you serve this:

<img src="http://cookiedata@example.com/image.gif>;