diff --git a/docs/topics/downloader-middleware.rst b/docs/topics/downloader-middleware.rst
index cef4162d8..9a1dcf4bf 100644
--- a/docs/topics/downloader-middleware.rst
+++ b/docs/topics/downloader-middleware.rst
@@ -328,16 +328,16 @@ HttpAuthMiddleware
     ``http_auth_domain`` spider attribute to the domain which requires this
     authentication (its subdomains will be also handled in the same way).
     You can set ``http_auth_domain`` to ``None`` to enable the
-    authentication for all requests but usually this is not needed.
+    authentication for all requests but you risk leaking your authentication
+    credentials to unrelated domains.
 
     .. warning::
-        In the previous Scrapy versions HttpAuthMiddleware sent the
-        authentication data with all requests, which is a security problem if
-        the spider makes requests to several different domains. Currently if
-        the ``http_auth_domain`` attribute is not set, the middleware will use
-        the domain of the first request, which will work for some spider but
-        not for others. In the future the middleware will produce an error
-        instead.
+        In previous Scrapy versions HttpAuthMiddleware sent the authentication
+        data with all requests, which is a security problem if the spider
+        makes requests to several different domains. Currently if the
+        ``http_auth_domain`` attribute is not set, the middleware will use the
+        domain of the first request, which will work for some spiders but not
+        for others. In the future the middleware will produce an error instead.
 
     Example::