fix: solve issues with basic auth username:password in URLs (#11179)

* fix: `history.replaceState` with absolute path instead of href (#10522)

* fix: detect basic auth credentials in URL and remove them

* fix: detect basic auth credentials with `document.URL`

* fix: remove location.href from replaceState

Workaround for chromium bug #10522

* fix: change basic auth url credentials detection

* Update packages/kit/src/runtime/client/client.js

* Update .changeset/long-adults-arrive.md

---------

Co-authored-by: Rich Harris <hello@rich-harris.dev>

.changeset/long-adults-arrive.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: reload page on startup if `document.URL` contains credentials

packages/kit/src/runtime/client/client.js

@@ -223,6 +223,14 @@ export async function start(_app, _target, hydrate) {
 		);
 	}
 
+	// detect basic auth credentials in the current URL
+	// https://github.com/sveltejs/kit/pull/11179
+	// if so, refresh the page without credentials
+	if (document.URL !== location.href) {
+		// eslint-disable-next-line no-self-assign
+		location.href = location.href;
+	}
+
 	app = _app;
 	routes = parse(_app);
 	container = __SVELTEKIT_EMBEDDED__ ? _target : document.documentElement;
@@ -251,8 +259,7 @@ export async function start(_app, _target, hydrate) {
 				[HISTORY_INDEX]: current_history_index,
 				[NAVIGATION_INDEX]: current_navigation_index
 			},
-			'',
-			location.href
+			''
 		);
 	}