Hello,

Some user decided to use my app behind an Apache basic auth and some of the libraries I use started throwing errors about URLs. Turns out it was because they had a @ in their password.

And inded this code:

$url = new \Slim\Http\Uri('https', 'example.com', 443, '/', '', '', 'foo', 'b@r');
$url->getBaseUrl();

returns https://foo:b@[email protected].

But according the URL standard, the user and password should be percent-encoded: https://foo:b%[email protected].