The full base-URL rule set, in order: no whitespace or control characters
(baseUrlWhitespaceProblem), an absolute URL, an http:/https: scheme, no
query or fragment, and no % in the userinfo that doesn't start a valid escape
(%25 for a literal one). Request paths are appended to the base URL as a string, so a
? or # in it would swallow every path: http://h/?x=1 requests
/?x=1/webservices/... and http://h/#f requests /. A path prefix is fine, and
userinfo is allowed (Node sends it as Basic auth). The reasons name no URL, so a
credential in it never reaches a message.
The full base-URL rule set, in order: no whitespace or control characters (baseUrlWhitespaceProblem), an absolute URL, an
http:/https:scheme, no query or fragment, and no%in the userinfo that doesn't start a valid escape (%25for a literal one). Request paths are appended to the base URL as a string, so a?or#in it would swallow every path:http://h/?x=1requests/?x=1/webservices/...andhttp://h/#frequests/. A path prefix is fine, and userinfo is allowed (Node sends it as Basic auth). The reasons name no URL, so a credential in it never reaches a message.