Run probe against each candidate base URL until one succeeds, and hand
back what it returned. Any failure means "no service here": a wrong base
answers with a 404, or with an SPA's HTML index that fails to parse.
A probe may therefore run against a base URL that turns out to be wrong,
so it must not commit anything (persist a session, register a client)
before the request that proves the address is right has succeeded.
When every candidate fails, the error thrown is the most actionable one
available, in this order: a rejected-credentials error (the user's
likelier mistake, and it proves the address was right), then any error
naming a status and URL, then the first candidate's — so the message
describes what the user entered rather than a guess they never made. The
middle rung matters because a cross-origin probe that CORS blocks rejects
with a bare TypeError carrying neither status nor URL.
Run
probeagainst each candidate base URL until one succeeds, and hand back what it returned. Any failure means "no service here": a wrong base answers with a 404, or with an SPA's HTML index that fails to parse.A probe may therefore run against a base URL that turns out to be wrong, so it must not commit anything (persist a session, register a client) before the request that proves the address is right has succeeded.
When every candidate fails, the error thrown is the most actionable one available, in this order: a rejected-credentials error (the user's likelier mistake, and it proves the address was right), then any error naming a status and URL, then the first candidate's — so the message describes what the user entered rather than a guess they never made. The middle rung matters because a cross-origin probe that CORS blocks rejects with a bare TypeError carrying neither status nor URL.