Rule for the base URL, in this order: a string; no whitespace or control
characters (baseUrlSpaceProblem); parseable by new URL(); an http: or
https: scheme; no query or fragment. Request paths are appended to the base URL
as a string, so a ? or # would swallow every path (http://h/?x=1 requested
/?x=1/api/..., http://h/#f requested /); a % in the user name or password
that starts a valid escape (%25 for a literal one: Node decodes the userinfo for the
Authorization header and failed at request time). Userinfo is allowed (Basic auth for
a protected mirror) and never appears in a message.
Rule for the base URL, in this order: a string; no whitespace or control characters (baseUrlSpaceProblem); parseable by
new URL(); anhttp:orhttps:scheme; no query or fragment. Request paths are appended to the base URL as a string, so a?or#would swallow every path (http://h/?x=1requested/?x=1/api/...,http://h/#frequested/); a%in the user name or password that starts a valid escape (%25for a literal one: Node decodes the userinfo for the Authorization header and failed at request time). Userinfo is allowed (Basic auth for a protected mirror) and never appears in a message.