Every rule for a base URL, in order: a non-blank string, no whitespace or control
characters (see baseUrlWhitespaceProblem), a parseable URL, the http: or
https: scheme, no query or fragment — feed paths are appended to the base URL as
a string, so a ? or # would swallow every path (http://h/#f requests /) —
and userinfo that decodes: Node decodes a user:password@ into the Authorization
header and fails at request time on a % that isn't an escape (write a literal
% as %25). The reasons never echo the URL, so a credential in it cannot leak.
Every rule for a base URL, in order: a non-blank string, no whitespace or control characters (see baseUrlWhitespaceProblem), a parseable URL, the
http:orhttps:scheme, no query or fragment — feed paths are appended to the base URL as a string, so a?or#would swallow every path (http://h/#frequests/) — and userinfo that decodes: Node decodes auser:password@into the Authorization header and fails at request time on a%that isn't an escape (write a literal%as%25). The reasons never echo the URL, so a credential in it cannot leak.