I mean, for HTTP Basic there literally is a single canonical string, and it's not uncommon to see people send you links like https://user:somepasswordhere@examp

I mean, for HTTP Basic there literally is a single canonical string, and it's not uncommon to see people send you links like https://user:somepasswordhere@example.com https://user:somepasswordhere@example.com. I think the arguments other commenters have made about logging, browser history storage, etc are more convincing