Feature request: username entered as part of the URL is not used

[jnweiger]

Pre-submission Checks

• I checked for similar issues, but could not find any. I also checked the closed issues. I could not contribute additional information to any existing issue.
• I will take the time to fill in all the required fields. I know that the bug report may be dismissed otherwise due to lack of information.

Describe the QA issue

Seen with testpilotcloud client 4.1.0
(Minor nitpick only)

• start the client, the connection wizard opens,
• enter "[email protected]" as a URL. The URL is accepted. OKish
• On the next page, the wizard asks for both, username and password

---

• Entering the username twice does not make sense. How do I know which one takes precedence, if they differ? BAD

Expected behaviour:

• the Username: [ ] field should be prefilled, with the username found in the URL
• (or a URL with a username should not be accepted)

Steps to reproduce the issue

.

Screenshots

.

Expected behavior

No response

Actual behavior

No response

[michaelstingl]

Expected behavior

Basic auth

Username field could be pre-filled with information from URL

OAuth 2.0 / OpenID Connect

&user=demo should be added to the IDP URL

Actual behavior

Desktop client opens https://[email protected]/index.php/apps/oauth2/authorize?response_type=code&client_id=xdXOt13…

Needs more URL sanitizing?

[TheOneRing]

We just don't support credentials in the url anymore.
We did in the past but they where in part stored in the settings and in other code paths again stripped from the url.

[TheOneRing]

Expected behavior

Basic auth

Username field could be pre-filled with information from URL

OAuth 2.0 / OpenID Connect

&user=demo should be added to the IDP URL

Actual behavior

Desktop client opens https://[email protected]/index.php/apps/oauth2/authorize?response_type=code&client_id=xdXOt13…

Needs more URL sanitizing?

But yes we should strip plaintext user info from the url in the wizard.

[TheOneRing]

We won't implement the feature request but sanitize the url #11497