Function resolve_same_origin 

pub fn resolve_same_origin(base_url: &str, path: &str) -> Result<String>

Resolve an action’s path against the client’s base URL, refusing any other origin.

The HTTP-family clients put the startup default_headers (API keys, cookies) and, for WebDAV, the auth credential as Authorization: Basic on every request, and the model that chooses path reads the peer’s responses. So a client is bound to one origin, its remote_addr, and every URL this returns is on it; anything else is refused by name, so the repair loop can see it and the operator can open a client for that host on purpose. A base_url without a scheme is http://.

• An absolute http(s):// path (any letter case) is accepted when its origin is the base’s — what a model copying a Location header produces.
• Any other path is appended to the base, with a / inserted unless it already starts with /, ? or # or the base ends with /. The separator is what keeps the text in the path: appended bare, @attacker.example/x would become the host (the base turned into userinfo), .attacker.example/ would extend the host and :9999/ would set the port.
• Whatever the route, the final URL is parsed with the WHATWG parser (url, the one reqwest uses), its scheme, host and port compared with the base’s, and userinfo the base did not carry is refused. The returned string is that parse’s serialization, so the request is sent to exactly the URL that was checked.