News for hackers. Stuff that matters.
Re:Show HN: Just F-Ing Ping by n0ot on Friday January 12, 2024 @11:56PM (#38977452)
I don't think you're stripping the userinfo quite right. You're stripping everything after the at-sign, when you want to strip what's before:

  scheme://user:[email protected]:port/path?query_key=query_value&another_key=another_value#fragment
Re:Show HN: Just F-Ing Ping by ithkuil on Saturday January 13, 2024 @05:15AM (#38978610)
Doesn't chrome remove the user info (or at least the password part) from the URL?

(On mobile now cannot check)

EDIT: check: it does it only after successful access. If the browser still presents the basic auth window because the backend responds unauthorized then copy&paste data will contain the full userinfo

Re:Show HN: Just F-Ing Ping by OskarS on Saturday January 13, 2024 @06:58AM (#38979187)
Seems like an excellent use case for trurl [1], a tool built on curls url parsing functions (which can presumably handle any weird url format you throw at it), though I'm not sure how well packaged/available it is.

[1]: https://github.com/curl/trurl