What travels unencrypted when requests go to baseUrl, as one sentence for the
cleartext warning (a WARN record of oparl.http) — or undefined when nothing does: an https: URL, a URL that does
not parse (the base-URL check reports that), or a loopback host (localhost,
127.0.0.0/8, ::1). The sentence names the host (url.host, host and port) and what
is sent with each request: the base URL's own credentials (userinfo) and any other
secret passed as a noun phrase in secrets (e.g. "the API key"). It never contains
a password or key. The CLI prints it once per run, before the first request.
oparl has no base URL: every command names the URL it starts from (a System, Body or
object URL, or the endpoint registry), so the CLI passes that start URL here, once per
run; the links a server hands out on the way are not checked again.
What travels unencrypted when requests go to
baseUrl, as one sentence for the cleartext warning (a WARN record ofoparl.http) — orundefinedwhen nothing does: anhttps:URL, a URL that does not parse (the base-URL check reports that), or a loopback host (localhost,127.0.0.0/8,::1). The sentence names the host (url.host, host and port) and what is sent with each request: the base URL's own credentials (userinfo) and any other secret passed as a noun phrase insecrets(e.g."the API key"). It never contains a password or key. The CLI prints it once per run, before the first request.oparl has no base URL: every command names the URL it starts from (a System, Body or object URL, or the endpoint registry), so the CLI passes that start URL here, once per run; the links a server hands out on the way are not checked again.