Every rule for a base URL, in order: a non-blank string, no whitespace or control
characters (see baseUrlWhitespaceProblem), a parseable absolute URL, the
http: or https: scheme, and no query or fragment — request paths are appended
to the base URL as a string, so a ? or # would swallow every path
(http://h/?x=1 requests /?x=1/api2u/news/, http://h/#f requests /).
Userinfo is allowed (sent as Basic auth); a % in it must start a valid escape (%25
for a literal one), as it is decoded for the Authorization header. The reasons never
echo the URL, so a credential in it cannot leak.
Every rule for a base URL, in order: a non-blank string, no whitespace or control characters (see baseUrlWhitespaceProblem), a parseable absolute URL, the
http:orhttps:scheme, and no query or fragment — request paths are appended to the base URL as a string, so a?or#would swallow every path (http://h/?x=1requests/?x=1/api2u/news/,http://h/#frequests/). Userinfo is allowed (sent as Basic auth); a%in it must start a valid escape (%25for a literal one), as it is decoded for the Authorization header. The reasons never echo the URL, so a credential in it cannot leak.