A base URL (baseUrl, --base-url): an absolute http(s) URL, checked on the RAW
value. new URL() silently trims surrounding whitespace and drops tab/CR/LF, but
the engine appends request paths to the raw string, so a padded value would
request /%20/... or reach a custom transport unparsed. A query or fragment
would swallow every request path (http://h/#f requests / for every call).
A % in the user name or password must start a valid escape (%25 for a literal
one): the userinfo is decoded for the Authorization header. Userinfo is allowed
(it is redacted from every message). The reasons never echo the value, so a
credential in it cannot leak.
A base URL (
baseUrl,--base-url): an absolute http(s) URL, checked on the RAW value. new URL() silently trims surrounding whitespace and drops tab/CR/LF, but the engine appends request paths to the raw string, so a padded value would request/%20/...or reach a custom transport unparsed. A query or fragment would swallow every request path (http://h/#frequests/for every call). A%in the user name or password must start a valid escape (%25for a literal one): the userinfo is decoded for the Authorization header. Userinfo is allowed (it is redacted from every message). The reasons never echo the value, so a credential in it cannot leak.