Why requests to baseUrl would cross the network unencrypted, or undefined.
Returns undefined for an https: URL, for one that does not parse, and for the
loopback interface (localhost, 127.0.0.0/8, ::1). For any other plain
http: URL it returns one sentence (no warning: prefix) naming the host
(url.host: host and port, never the userinfo) and what secret travels with the
requests: secrets are noun phrases such as "the API key", and a user:password@
in the URL adds "the base URL's credentials". The secrets themselves are never in
the sentence. Not an error (a mirror on a trusted network is a legitimate setup),
so the CLI logs it as a WARN record of dip.http (once per run, before the first
request); a missing "s" is an easy slip, and DIP itself only answers plain http
with a redirect to https.
requests to <host> are sent unencrypted (http:, not https:)
the API key is sent unencrypted to <host> (http:, not https:)
the API key and the base URL's credentials are sent unencrypted to <host> (http:, not https:)
Why requests to
baseUrlwould cross the network unencrypted, orundefined.Returns
undefinedfor anhttps:URL, for one that does not parse, and for the loopback interface (localhost,127.0.0.0/8,::1). For any other plainhttp:URL it returns one sentence (nowarning:prefix) naming the host (url.host: host and port, never the userinfo) and what secret travels with the requests:secretsare noun phrases such as"the API key", and auser:password@in the URL adds "the base URL's credentials". The secrets themselves are never in the sentence. Not an error (a mirror on a trusted network is a legitimate setup), so the CLI logs it as aWARNrecord ofdip.http(once per run, before the first request); a missing "s" is an easy slip, and DIP itself only answers plain http with a redirect to https.requests to <host> are sent unencrypted (http:, not https:)the API key is sent unencrypted to <host> (http:, not https:)the API key and the base URL's credentials are sent unencrypted to <host> (http:, not https:)