A base URL. Data paths are appended to it as a string, so its exact text matters:
blank is refused (only an omitted base URL selects the default host);
surrounding whitespace is refused: new URL() trims it silently, but the
engine uses the raw value, so "https://h/ " would request /%20/dam/...;
only http:/https: are accepted: a file:/ftp: value fails here, as a
configuration mistake, rather than deep in a (possibly custom) transport;
a ? or # would swallow every path (http://h/?x requests /?x/dam/...,
http://h/#f requests /).
a control character is refused: new URL() drops tab/CR/LF silently;
userinfo (user:pass@) is allowed, but it must decode: Node decodes it into the
Authorization header and fails at request time ("URI malformed", reported as a
network error) on a % that isn't an escape, so that is a usage error here
(write a literal % as %25).
The reasons never echo the URL, so a credential in it cannot leak; error messages
redact the userinfo.
A base URL. Data paths are appended to it as a string, so its exact text matters:
blank is refused (only an omitted base URL selects the default host);
surrounding whitespace is refused:
new URL()trims it silently, but the engine uses the raw value, so"https://h/ "would request/%20/dam/...;only
http:/https:are accepted: afile:/ftp:value fails here, as a configuration mistake, rather than deep in a (possibly custom) transport;a
?or#would swallow every path (http://h/?xrequests/?x/dam/...,http://h/#frequests/).a control character is refused:
new URL()drops tab/CR/LF silently;userinfo (
user:pass@) is allowed, but it must decode: Node decodes it into the Authorization header and fails at request time ("URI malformed", reported as a network error) on a%that isn't an escape, so that is a usage error here (write a literal%as%25).The reasons never echo the URL, so a credential in it cannot leak; error messages redact the userinfo.