A base URL (baseUrl, staticBaseUrl) must be an absolute http:/https: URL
without a query or fragment, and without whitespace or control characters.
new URL() trims surrounding whitespace and drops tab/CR/LF silently, so the raw
string is checked rather than the parsed one; request paths are appended to the
base's path, so a ? or # would swallow them. Userinfo (user:pw@) is allowed:
the engine sends it as Basic auth, for a proxy or mirror behind a login; a % in it
must start a valid escape (%25 for a literal one).
A base URL (
baseUrl,staticBaseUrl) must be an absolutehttp:/https:URL without a query or fragment, and without whitespace or control characters.new URL()trims surrounding whitespace and drops tab/CR/LF silently, so the raw string is checked rather than the parsed one; request paths are appended to the base's path, so a?or#would swallow them. Userinfo (user:pw@) is allowed: the engine sends it as Basic auth, for a proxy or mirror behind a login; a%in it must start a valid escape (%25for a literal one).