On Wed, 26 Mar 2014, Steve Holme wrote:

> Does anyone have any views to whether supplying a username and password to a
> server that doesn't support authentication is a valid use case and should
> work as if no username/password had been supplied?

Could it be used by a malicious server to trick the client into giving away
its credentials in a way it wouldn't otherwise do it?

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette:  http://curl.haxx.se/mail/etiquette.html