Basic auth is sent to subsequent domains as well

If I enable basic auth for running a test on and page contains, for example, a js file loaded from then the basic auth Authorization header is being sent to that domain as well.

Do you think this is a desired behaviour ?

Desired or not, it is the expected behavior. The auth header is added to all requests and there isn’t support for only adding it to requests for certain origins.

Expected where ? As far as I know, this is not how the browser works.