Variable: HTTPS_URL_PATTERN

const HTTPS_URL_PATTERN: "^https://[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+(?::[0-9]{1,5})?(?:[/?#][^\s]*)?$"

Defined in: packages/contracts/src/schemas/federation.ts:153

The shape of a StrictHttpsUrl: https://, a host spelled as HOSTNAME_PATTERN spells one, an optional port, then nothing or a path, query or fragment, with no whitespace anywhere.

There is no user information. https://authority.example.org@attacker.example/x names the host attacker.example, and a reader who stops at the first host-like text sees the authority's; requiring the host straight after the scheme, so that no @ can come before the first /, keeps the two readings the same (the security review of 2026-10-14).