Every rule for a base URL, in order: a non-blank string without surrounding
whitespace or control characters, a parseable URL, the http: or https: scheme,
no query or fragment, and userinfo that decodes. Request paths are appended to the
base URL as a string, so a ? or # would swallow every path and the states
filter (http://h/v1?x=1 requests /v1?x=1/data/stations, http://h/v1#f
requests /v1), and a trailing space would land in the path: new URL() trims
surrounding whitespace and drops tab/CR/LF silently, so the raw string is checked.
Node decodes a user:password@ into the Authorization header and fails at request
time on a % that isn't an escape, so that is rejected here too (write a literal
% as %25). The reasons never echo the URL, so a credential in it cannot leak.
Every rule for a base URL, in order: a non-blank string without surrounding whitespace or control characters, a parseable URL, the
http:orhttps:scheme, no query or fragment, and userinfo that decodes. Request paths are appended to the base URL as a string, so a?or#would swallow every path and thestatesfilter (http://h/v1?x=1requests/v1?x=1/data/stations,http://h/v1#frequests/v1), and a trailing space would land in the path:new URL()trims surrounding whitespace and drops tab/CR/LF silently, so the raw string is checked. Node decodes auser:password@into the Authorization header and fails at request time on a%that isn't an escape, so that is rejected here too (write a literal%as%25). The reasons never echo the URL, so a credential in it cannot leak.