Rule for the base URL: an absolute http:/https: URL with no query or
fragment, no surrounding whitespace, and no % in the userinfo that doesn't start
an escape (%25 for a literal one: the engine percent-decodes it for the
Authorization header). Request paths are appended to it as a
string, so a ? or # would swallow every path, and new URL() trims
surrounding whitespace silently while the engine would keep the raw value
("https://h/ " requested /%20/api/v2/...).
Rule for the base URL: an absolute
http:/https:URL with no query or fragment, no surrounding whitespace, and no%in the userinfo that doesn't start an escape (%25for a literal one: the engine percent-decodes it for the Authorization header). Request paths are appended to it as a string, so a?or#would swallow every path, andnew URL()trims surrounding whitespace silently while the engine would keep the raw value ("https://h/ "requested/%20/api/v2/...).