A base URL must be an absolute http:/https: URL without a query or fragment,
and without whitespace or control characters. new URL() trims surrounding
whitespace and drops tab/CR/LF silently, so the raw string is checked rather
than the parsed one; request paths are appended to the base's path as text, so
a ? or # would swallow them and every call would fetch the base URL itself.
Userinfo (user:pw@) is allowed, and redacted in messages; a % in it must start a
valid escape (%25 for a literal one), as Node decodes it for the Authorization header.
A base URL must be an absolute
http:/https:URL without a query or fragment, and without whitespace or control characters.new URL()trims surrounding whitespace and drops tab/CR/LF silently, so the raw string is checked rather than the parsed one; request paths are appended to the base's path as text, so a?or#would swallow them and every call would fetch the base URL itself. Userinfo (user:pw@) is allowed, and redacted in messages; a%in it must start a valid escape (%25for a literal one), as Node decodes it for the Authorization header.