From 157cfdeeb345bda098e67a03b2595fcaeb2850ad Mon Sep 17 00:00:00 2001
From: Steven <steven@ceriously.com>
Date: Tue, 2 Sep 2025 15:49:10 -0400
Subject: [PATCH] doc: provide alternative to `url.parse()` using WHATWG URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/59736
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/url.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/doc/api/url.md b/doc/api/url.md
index 3e86e25eaf..d82ddb869e 100644
--- a/doc/api/url.md
+++ b/doc/api/url.md
@@ -1847,7 +1847,15 @@ A `URIError` is thrown if the `auth` property is present but cannot be decoded.
 strings. It is prone to security issues such as [host name spoofing][]
 and incorrect handling of usernames and passwords. Do not use with untrusted
 input. CVEs are not issued for `url.parse()` vulnerabilities. Use the
-[WHATWG URL][] API instead.
+[WHATWG URL][] API instead, for example:
+
+```js
+function getURL(req) {
+  const proto = req.headers['x-forwarded-proto'] || 'https';
+  const host = req.headers['x-forwarded-host'] || req.headers.host || 'example.com';
+  return new URL(req.url || '/', `${proto}://${host}`);
+}
+```
 
 ### `url.resolve(from, to)`