Why value cannot be used as the base URL, or undefined when it can. The engine
appends every request path to the base URL as a string, so the rules guard the
request URL it builds:
it must parse as an absolute URL with an http: or https: scheme (a file: or
ftp: base URL would otherwise reach a custom transport that does no such check);
no ? or #: either would swallow every path (http://h/?x=1 requests
/?x=1/o/autobahn/..., http://h/#f requests /);
a % in the user name or password must start a valid escape (%25 for a literal one):
Node decodes the userinfo for the Authorization header and fails at request time;
no surrounding whitespace (U+00A0 included) and no control character anywhere:
new URL() trims or drops them silently, but the raw string is what gets sent, so
"https://h/ " would request /%20/o/autobahn/.
The reasons never repeat the value, so a credential in it cannot reach a message.
The engine enforces it (as Invalid option baseUrl: <reason>), and the CLI's
--base-url parser calls it.
Why
valuecannot be used as the base URL, or undefined when it can. The engine appends every request path to the base URL as a string, so the rules guard the request URL it builds:http:orhttps:scheme (afile:orftp:base URL would otherwise reach a custom transport that does no such check);?or#: either would swallow every path (http://h/?x=1requests/?x=1/o/autobahn/...,http://h/#frequests/);%in the user name or password must start a valid escape (%25for a literal one): Node decodes the userinfo for the Authorization header and fails at request time;new URL()trims or drops them silently, but the raw string is what gets sent, so"https://h/ "would request/%20/o/autobahn/.The reasons never repeat the value, so a credential in it cannot reach a message. The engine enforces it (as
Invalid option baseUrl: <reason>), and the CLI's--base-urlparser calls it.