Why value cannot be used as the base URL, or undefined when it can. The engine
appends every request path to the base URL as a string, so the rules guard the
request URL it builds:
it must parse as an absolute URL with an http: or https: scheme (a file: or
ftp: base URL would otherwise reach a custom transport that does no such check);
no ? or #: either would swallow every path (http://h/?x=1 posts to
/?x=1/STATION_SMALL, http://h/#f to /);
no surrounding whitespace and no control character anywhere: new URL() trims or
drops them silently, but the raw string is what gets sent, so "https://h/x "
would post to /x%20/STATION_SMALL.
Userinfo (user:pw@) is allowed: it is sent as Basic auth and redacted in every
error message. A % in it must start a valid escape (%25 for a literal one), as
Node decodes it for the Authorization header. The reasons never repeat the value, so a credential in it cannot
reach a message. The engine enforces it (Invalid baseUrl: <reason>), and the
CLI's --base-url parser calls it.
Why
valuecannot be used as the base URL, or undefined when it can. The engine appends every request path to the base URL as a string, so the rules guard the request URL it builds:http:orhttps:scheme (afile:orftp:base URL would otherwise reach a custom transport that does no such check);?or#: either would swallow every path (http://h/?x=1posts to/?x=1/STATION_SMALL,http://h/#fto/);new URL()trims or drops them silently, but the raw string is what gets sent, so"https://h/x "would post to/x%20/STATION_SMALL.Userinfo (
user:pw@) is allowed: it is sent as Basic auth and redacted in every error message. A%in it must start a valid escape (%25for a literal one), as Node decodes it for the Authorization header. The reasons never repeat the value, so a credential in it cannot reach a message. The engine enforces it (Invalid baseUrl: <reason>), and the CLI's--base-urlparser calls it.