Every rule for a base URL, in order: a non-blank string without surrounding
whitespace or control characters, a parseable URL, the http: or https: scheme,
no query or fragment, and userinfo that decodes. Request paths are appended to the
base URL as a string, so a ? or # would swallow every path (http://h/?x=1
requests /?x=1/___LMW-Redaktion/..., http://h/#f requests /), and a trailing
space would land in the path (/ok%20/___LMW…): new URL() trims surrounding
whitespace and drops tab/CR/LF silently, so the raw string is checked. Node decodes
a user:password@ into the Authorization header and fails at request time on a %
that isn't an escape, so that is rejected here too (write a literal % as %25).
The reasons never echo the URL, so a credential in it cannot leak.
Every rule for a base URL, in order: a non-blank string without surrounding whitespace or control characters, a parseable URL, the
http:orhttps:scheme, no query or fragment, and userinfo that decodes. Request paths are appended to the base URL as a string, so a?or#would swallow every path (http://h/?x=1requests/?x=1/___LMW-Redaktion/...,http://h/#frequests/), and a trailing space would land in the path (/ok%20/___LMW…):new URL()trims surrounding whitespace and drops tab/CR/LF silently, so the raw string is checked. Node decodes auser:password@into the Authorization header and fails at request time on a%that isn't an escape, so that is rejected here too (write a literal%as%25). The reasons never echo the URL, so a credential in it cannot leak.