Basic auth is sent to subsequent domains as well

Support
1

If I enable basic auth for running a test on https://foo.com and foo.com page contains, for example, a js file loaded from https://cdn.bar.com/bundle.js then the basic auth Authorization header is being sent to that domain as well.

Do you think this is a desired behaviour ?

2

Desired or not, it is the expected behavior. The auth header is added to all requests and there isn’t support for only adding it to requests for certain origins.

3

Expected where ? As far as I know, this is not how the browser works.