{"version":"2.1.260","anchor":"new-url-validation-rejects-credentialsbackslashes-in-manage","canonical_anchor":"new-url-validation-rejects-credentialsbackslashes-in-manage","heading":"New URL validation rejects credentials\/backslashes in managed-config URLs","tier":"notice","area":"Admin Settings","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/new-url-validation-rejects-credentialsbackslashes-in-manage","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### New URL validation rejects credentials\/backslashes in managed-config URLs\n\nManaged config URLs with embedded credentials or backslashes are now rejected.\n\nA new `urlWithSchemeCoercion` refinement rejects URLs whose authority contains userinfo (`user:pass@`) or a backslash, replacing the old bare `.url()` check. Managed config settings that take a URL now fail validation with the message `URL must not contain credentials or a backslash in the authority` instead of silently accepting a credentialed or spoofable URL.\n\n- Area: Admin Settings\n- Names: `urlWithSchemeCoercion`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}