>I've looked at RFCs 2617 (HTTP Auth), 1738 (URLs) and 2616 (HTTP 1.1).

The relevant spec is RFC 2396.  The slash should be encoded within
the URL and decoded by the library before being used as a password.

As I recall, Netscape and MSIE had various problems with encoded
passwords in URLs, and they are a bad idea in general for security
reasons, so don't count on them as a cross-platform solution.

....Roy

Reply via email to