Why value cannot be used as the base URL, or undefined when it can. The engine
appends every request path to the base URL as a string, so the rules guard the
request URL it builds:
it must be a string that parses as an absolute URL with an http: or https:
scheme (a file: or ftp: base URL would otherwise reach a custom transport that
does no such check);
no ? or #: either would swallow every path (http://h/?x=1 requests
/?x=1/v2/..., http://h/#f requests /);
a % in the user name or password must start a valid escape (%25 for a literal
one): Node decodes the userinfo for the Authorization header and fails at request
time;
no surrounding whitespace (U+00A0 included) and no control character anywhere:
new URL() trims or drops them silently, but the raw string is what gets sent, so
"http://h " would request http://h /v2/info and fail with "Invalid URL".
The reasons never repeat the value, so a credential in it cannot reach a message.
The engine enforces it (as Invalid baseUrl: <reason>), and the CLI's --base-url
parser calls it.
Why
valuecannot be used as the base URL, or undefined when it can. The engine appends every request path to the base URL as a string, so the rules guard the request URL it builds:http:orhttps:scheme (afile:orftp:base URL would otherwise reach a custom transport that does no such check);?or#: either would swallow every path (http://h/?x=1requests/?x=1/v2/...,http://h/#frequests/);%in the user name or password must start a valid escape (%25for a literal one): Node decodes the userinfo for the Authorization header and fails at request time;new URL()trims or drops them silently, but the raw string is what gets sent, so"http://h "would requesthttp://h /v2/infoand fail with "Invalid URL".The reasons never repeat the value, so a credential in it cannot reach a message. The engine enforces it (as
Invalid baseUrl: <reason>), and the CLI's--base-urlparser calls it.