I wonder what should happen in this case?

url.resolve('mailto:user@example.org', 'example.com')
'mailto:user@example.com'

"user@" technically is auth info here.

I don't think it should copy over. However, to change that would be semver-major imo. This would be better:

> var parsed = url.parse('mailto:user@example.org');
undefined
> parsed.host = 'example.com';
'example.com'
> url.format(parsed);
'mailto:user@example.com'

perhaps @domenic would be interested in reviewing?

What do browsers do? What does the spec (perhaps best tested via https://github.com/jsdom/whatwg-url) do?

I agree with @domenic. Our url module should align with the spec.

Looks like this was never resolved. There's really no question that the user id and password should not be getting copied over.. url.resolve('http://user:pass@example.org', 'http://example.com') should never resolve out to http://user:pass@example.com. AFAICT, that aligns with the url spec also.

@nodejs/http

I concur with @jasnell and this PR

New CI: https://ci.nodejs.org/job/node-test-pull-request/2370/

@nodejs/ctc ... amazingly, this PR was opened a year ago and still applies cleanly (albeit using a three way merge). It even passes linting! The change LGTM.

marked it semver-major because it changes the behavior of url.resolve to drop the auth but it could also be classified as a bug fix. PTAL

CI is green!

@mscdex @cjihrig @trevnorris ... can one of you give this a quick glance over?

LGTM

It only took 1 year and 5 days but this landed in eb4201f ;-)