I spent some time reading the RFC’s, following the various “superseded by” references.
With the https scheme, while the @
symbol has special meaning before the host portion of the URL, it does not have special meaning in the path.
https://user:password@example.org/@foo
^
special meaning
For example, Google Maps uses the @
symbol prior to geo coordinates:
https://www.google.com/maps/place/Paris,+France/@48.8588336,2.2769957,...
So it looks like we should allow this without percent encoding.
Although probably limited in scope, this change would break existing link references.