Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@akepinski/node-fetch
Advanced tools
A light-weight module that brings window.fetch to node.js
A light-weight module that brings window.fetch
to Node.js.
Instead of implementing XMLHttpRequest
in Node.js to run browser-specific Fetch polyfill, why not go from native http
to fetch
API directly? Hence, node-fetch
, minimal code for a window.fetch
compatible API on Node.js runtime.
See Matt Andrews' isomorphic-fetch or Leonardo Quixada's cross-fetch for isomorphic usage (exports node-fetch
for server-side, whatwg-fetch
for client-side).
window.fetch
API.res.text()
and res.json()
) to UTF-8 automatically.window.fetch
offers, feel free to open an issue.Current stable release (3.x
)
$ npm install node-fetch
// CommonJS
const fetch = require('node-fetch');
// ES Module
import fetch from 'node-fetch';
If you are using a Promise library other than native, set it through fetch.Promise
:
const fetch = require('node-fetch');
const Bluebird = require('bluebird');
fetch.Promise = Bluebird;
If you want to patch the global object in node:
const fetch = require('node-fetch');
if (!globalThis.fetch) {
globalThis.fetch = fetch;
}
For versions of node earlier than 12.x, use this globalThis
polyfill:
(function() {
if (typeof globalThis === 'object') return;
Object.defineProperty(Object.prototype, '__magic__', {
get: function() {
return this;
},
configurable: true
});
__magic__.globalThis = __magic__;
delete Object.prototype.__magic__;
}());
Using an old version of node-fetch? Check out the following files:
NOTE: The documentation below is up-to-date with 3.x
releases, if you are using an older version, please check how to upgrade.
const fetch = require('node-fetch');
fetch('https://github.com/')
.then(res => res.text())
.then(body => console.log(body));
const fetch = require('node-fetch');
fetch('https://api.github.com/users/github')
.then(res => res.json())
.then(json => console.log(json));
const fetch = require('node-fetch');
fetch('https://httpbin.org/post', {method: 'POST', body: 'a=1'})
.then(res => res.json()) // expecting a json response
.then(json => console.log(json));
const fetch = require('node-fetch');
const body = {a: 1};
fetch('https://httpbin.org/post', {
method: 'post',
body: JSON.stringify(body),
headers: {'Content-Type': 'application/json'}
})
.then(res => res.json())
.then(json => console.log(json));
URLSearchParams
is available on the global object in Node.js as of v10.0.0. See official documentation for more usage methods.
NOTE: The Content-Type
header is only set automatically to x-www-form-urlencoded
when an instance of URLSearchParams
is given as such:
const fetch = require('node-fetch');
const params = new URLSearchParams();
params.append('a', 1);
fetch('https://httpbin.org/post', {method: 'POST', body: params})
.then(res => res.json())
.then(json => console.log(json));
NOTE: 3xx-5xx responses are NOT exceptions, and should be handled in then()
, see the next section.
Adding a catch to the fetch promise chain will catch all exceptions, such as errors originating from node core libraries, like network errors, and operational errors which are instances of FetchError. See the error handling document for more details.
const fetch = require('node-fetch');
fetch('https://domain.invalid/').catch(err => console.error(err));
It is common to create a helper function to check that the response contains no client (4xx) or server (5xx) error responses:
const fetch = require('node-fetch');
function checkStatus(res) {
if (res.ok) {
// res.status >= 200 && res.status < 300
return res;
} else {
throw MyCustomError(res.statusText);
}
}
fetch('https://httpbin.org/status/400')
.then(checkStatus)
.then(res => console.log('will not get here...'));
The "Node.js way" is to use streams when possible:
const {createWriteStream} = require('fs');
const fetch = require('node-fetch');
fetch(
'https://octodex.github.com/images/Fintechtocat.png'
).then(res => {
const dest = fs.createWriteStream('./octocat.png');
res.body.pipe(dest);
});
If you prefer to cache binary data in full, use buffer(). (NOTE: buffer() is a node-fetch
only API)
const fetch = require('node-fetch');
const fileType = require('file-type');
fetch('https://octodex.github.com/images/Fintechtocat.png')
.then(res => res.buffer())
.then(buffer => fileType(buffer))
.then(type => {
console.log(type);
});
const fetch = require('node-fetch');
fetch('https://github.com/').then(res => {
console.log(res.ok);
console.log(res.status);
console.log(res.statusText);
console.log(res.headers.raw());
console.log(res.headers.get('content-type'));
});
Unlike browsers, you can access raw Set-Cookie
headers manually using Headers.raw()
. This is a node-fetch
only API.
const fetch = require('node-fetch');
fetch('https://example.com').then(res => {
// returns an array of values, instead of a string of comma-separated values
console.log(res.headers.raw()['set-cookie']);
});
const {createReadStream} = require('fs');
const fetch = require('node-fetch');
const stream = createReadStream('input.txt');
fetch('https://httpbin.org/post', {method: 'POST', body: stream})
.then(res => res.json())
.then(json => console.log(json));
const fetch = require('node-fetch');
const FormData = require('form-data');
const form = new FormData();
form.append('a', 1);
fetch('https://httpbin.org/post', {method: 'POST', body: form})
.then(res => res.json())
.then(json => console.log(json));
// OR, using custom headers
// NOTE: getHeaders() is non-standard API
const options = {
method: 'POST',
body: form,
headers: form.getHeaders()
};
fetch('https://httpbin.org/post', options)
.then(res => res.json())
.then(json => console.log(json));
You may cancel requests with AbortController
. A suggested implementation is abort-controller
.
An example of timing out a request after 150ms could be achieved as the following:
const fetch = require('node-fetch');
const AbortController = require('abort-controller');
const controller = new AbortController();
const timeout = setTimeout(() => {
controller.abort();
}, 150);
fetch('https://example.com', {signal: controller.signal})
.then(res => res.json())
.then(
data => {
useData(data);
},
err => {
if (err.name === 'AbortError') {
console.log('request was aborted');
}
}
)
.finally(() => {
clearTimeout(timeout);
});
See test cases for more examples.
url
A string representing the URL for fetchingoptions
Options for the HTTP(S) requestPromise<Response>
Perform an HTTP(S) fetch.
url
should be an absolute url, such as https://example.com/
. A path-relative URL (/file/under/root
) or protocol-relative URL (//can-be-http-or-https.com/
) will result in a rejected Promise
.
The default values are shown after each option key.
{
// These properties are part of the Fetch Standard
method: 'GET',
headers: {}, // request headers. format is the identical to that accepted by the Headers constructor (see below)
body: null, // request body. can be null, a string, a Buffer, a Blob, or a Node.js Readable stream
redirect: 'follow', // set to `manual` to extract redirect headers, `error` to reject redirect
signal: null, // pass an instance of AbortSignal to optionally abort requests
// The following properties are node-fetch extensions
follow: 20, // maximum redirect count. 0 to not follow redirect
timeout: 0, // req/res timeout in ms, it resets on redirect. 0 to disable (OS limit applies). Signal is recommended instead.
compress: true, // support gzip/deflate content encoding. false to disable
size: 0, // maximum response body size in bytes. 0 to disable
agent: null, // http(s).Agent instance or function that returns an instance (see below)
highWaterMark: 16384 // the maximum number of bytes to store in the internal buffer before ceasing to read from the underlying resource.
}
If no values are set, the following request headers will be sent automatically:
Header | Value |
---|---|
Accept-Encoding | gzip,deflate (when options.compress === true ) |
Accept | */* |
Connection | close (when no options.agent is present) |
Content-Length | (automatically calculated, if possible) |
Transfer-Encoding | chunked (when req.body is a stream) |
User-Agent | node-fetch (+https://github.com/node-fetch/node-fetch) |
Note: when body
is a Stream
, Content-Length
is not set automatically.
The agent
option allows you to specify networking related options which are out of the scope of Fetch, including and not limited to the following:
See http.Agent
for more information.
In addition, the agent
option accepts a function that returns http
(s).Agent
instance given current URL, this is useful during a redirection chain across HTTP and HTTPS protocol.
const http = require('http');
const https = require('https');
const httpAgent = new http.Agent({
keepAlive: true
});
const httpsAgent = new https.Agent({
keepAlive: true
});
const options = {
agent: function(_parsedURL) {
if (_parsedURL.protocol == 'http:') {
return httpAgent;
} else {
return httpsAgent;
}
}
};
Stream on Node.js have a smaller internal buffer size (16Kb, aka highWaterMark
) from client-side browsers (>1Mb, not consistent across browsers). Because of that, when you are writing an isomorphic app and using res.clone()
, it will hang with large response in Node.
The recommended way to fix this problem is to resolve cloned response in parallel:
const fetch = require('node-fetch');
fetch('https://example.com').then(res => {
const r1 = res.clone();
return Promise.all([res.json(), r1.text()]).then(results => {
console.log(results[0]);
console.log(results[1]);
});
});
If for some reason you don't like the solution above, since 3.x
you are able to modify the highWaterMark
option:
const fetch = require('node-fetch');
fetch('https://example.com', {highWaterMark: 10}).then(res => res.clone().buffer());
An HTTP(S) request containing information about URL, method, headers, and the body. This class implements the Body interface.
Due to the nature of Node.js, the following properties are not implemented at this moment:
type
destination
referrer
referrerPolicy
mode
credentials
cache
integrity
keepalive
The following node-fetch extension properties are provided:
follow
compress
counter
agent
highWaterMark
See options for exact meaning of these extensions.
(spec-compliant)
input
A string representing a URL, or another Request
(which will be cloned)options
[Options][#fetch-options] for the HTTP(S) requestConstructs a new Request
object. The constructor is identical to that in the browser.
In most cases, directly fetch(url, options)
is simpler than creating a Request
object.
An HTTP(S) response. This class implements the Body interface.
The following properties are not implemented in node-fetch at this moment:
Response.error()
Response.redirect()
type
trailer
(spec-compliant)
body
A String
or Readable
streamoptions
A ResponseInit
options dictionaryConstructs a new Response
object. The constructor is identical to that in the browser.
Because Node.js does not implement service workers (for which this class was designed), one rarely has to construct a Response
directly.
(spec-compliant)
Convenience property representing if the request ended normally. Will evaluate to true if the response status was greater than or equal to 200 but smaller than 300.
(spec-compliant)
Convenience property representing if the request has been redirected at least once. Will evaluate to true if the internal redirect counter is greater than 0.
This class allows manipulating and iterating over a set of HTTP headers. All methods specified in the Fetch Standard are implemented.
(spec-compliant)
init
Optional argument to pre-fill the Headers
objectConstruct a new Headers
object. init
can be either null
, a Headers
object, an key-value map object or any iterable object.
// Example adapted from https://fetch.spec.whatwg.org/#example-headers-class
const Headers = require('node-fetch');
const meta = {
'Content-Type': 'text/xml',
'Breaking-Bad': '<3'
};
const headers = new Headers(meta);
// The above is equivalent to
const meta = [['Content-Type', 'text/xml'], ['Breaking-Bad', '<3']];
const headers = new Headers(meta);
// You can in fact use any iterable objects, like a Map or even another Headers
const meta = new Map();
meta.set('Content-Type', 'text/xml');
meta.set('Breaking-Bad', '<3');
const headers = new Headers(meta);
const copyOfHeaders = new Headers(headers);
Body
is an abstract interface with methods that are applicable to both Request
and Response
classes.
The following methods are not yet implemented in node-fetch at this moment:
formData()
(deviation from spec)
Readable
streamData are encapsulated in the Body
object. Note that while the Fetch Standard requires the property to always be a WHATWG ReadableStream
, in node-fetch it is a Node.js Readable
stream.
(spec-compliant)
Boolean
A boolean property for if this body has been consumed. Per the specs, a consumed body cannot be used again.
(spec-compliant)
Promise
Consume the body and return a promise that will resolve to one of these formats.
(node-fetch extension)
Promise<Buffer>
Consume the body and return a promise that will resolve to a Buffer.
(node-fetch extension)
An operational error in the fetching process. See ERROR-HANDLING.md for more info.
(node-fetch extension)
An Error thrown when the request is aborted in response to an AbortSignal
's abort
event. It has a name
property of AbortError
. See ERROR-HANDLING.MD for more info.
Since 3.x
types are bundled with node-fetch
, so you don't need to install any additional packages.
For older versions please use the type definitions from DefinitelyTyped:
$ npm install --save-dev @types/node-fetch
Thanks to github/fetch for providing a solid implementation reference.
David Frank | Jimmy Wärting | Antoni Kepinski | Richie Bendall | Gregor Martynus |
MIT
FAQs
A light-weight module that brings window.fetch to node.js
We found that @akepinski/node-fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.