A bare scheme://host[:port], or undefined when the input names no host.
scheme://host[:port]
Drops everything after the authority and assumes https for a bare hostname. Only http and https are accepted (an allowlist: javascript: must not reach a form action).
https
javascript:
A bare
scheme://host[:port], or undefined when the input names no host.Drops everything after the authority and assumes
httpsfor a bare hostname. Only http and https are accepted (an allowlist:javascript:must not reach a form action).