Say what a base URL on plain http: sends unencrypted, or undefined when nothing is.
Returns undefined for https:, for a value that doesn't parse as a URL, and for a
loopback host (localhost, 127.0.0.0/8, ::1), where nothing crosses the network.
Otherwise one sentence without a warning: prefix, naming the host (url.host: host
and port, never the userinfo) and what travels with the requests:
nothing secret: requests to <host> are sent unencrypted (http:, not https:);
userinfo in the URL: the base URL's credentials are sent unencrypted to <host> (…);
other secrets, given as noun phrases in secrets (e.g. "the API key"), are joined
with the userinfo phrase by "and".
Never the password or key itself. The CLI logs it once per run as a WARN record of
mastr.http on stderr; the register needs no secret, so it passes none.
Say what a base URL on plain
http:sends unencrypted, orundefinedwhen nothing is.Returns
undefinedforhttps:, for a value that doesn't parse as a URL, and for a loopback host (localhost,127.0.0.0/8,::1), where nothing crosses the network. Otherwise one sentence without awarning:prefix, naming the host (url.host: host and port, never the userinfo) and what travels with the requests:requests to <host> are sent unencrypted (http:, not https:);the base URL's credentials are sent unencrypted to <host> (…);secrets(e.g."the API key"), are joined with the userinfo phrase by "and". Never the password or key itself. The CLI logs it once per run as aWARNrecord ofmastr.httpon stderr; the register needs no secret, so it passes none.