Every engine rule for a base URL, in order: a URL that parses, the http: or
https: scheme, no query or fragment — request paths are appended to the base URL
as a string, so a ? or # would swallow every path (http://h/#f requests /)
— no whitespace or control characters (see baseUrlWhitespaceProblem), and no
% in the userinfo that doesn't start an escape (%25 for a literal one): the engine
percent-decodes it for the Authorization header.
The reasons never echo the URL, so a credential in it cannot leak. (A path that
already ends in the API path is the client's rule, baseUrlApiPathProblem.)
Every engine rule for a base URL, in order: a URL that parses, the
http:orhttps:scheme, no query or fragment — request paths are appended to the base URL as a string, so a?or#would swallow every path (http://h/#frequests/) — no whitespace or control characters (see baseUrlWhitespaceProblem), and no%in the userinfo that doesn't start an escape (%25for a literal one): the engine percent-decodes it for the Authorization header. The reasons never echo the URL, so a credential in it cannot leak. (A path that already ends in the API path is the client's rule,baseUrlApiPathProblem.)