
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
@bjoerge/xhr
Advanced tools
A small XMLHttpRequest wrapper. Designed for use with browserify, webpack etc.
API is a subset of request so you can write code that works in both node.js and the browser by using require('request') in your code and telling your browser bundler to load xhr instead of request.
For browserify, add a browser field to your package.json:
"browser": {
"request": "xhr"
}
For webpack, add a resolve.alias field to your configuration:
"resolve": {
"alias": {
"request$": "xhr"
}
}
Browser support: IE8+ and everything else.
var xhr = require("xhr")
xhr({
body: someJSONString,
uri: "/foo",
headers: {
"Content-Type": "application/json"
}
}, function (err, resp, body) {
// check resp.statusCode
})
var req = xhr(options, callback)type XhrOptions = String | {
useXDR: Boolean?,
sync: Boolean?,
uri: String,
url: String,
method: String?,
timeout: Number?,
headers: Object?,
body: String||Object?,
json: Boolean?,
username: String?,
password: String?,
withCredentials: Boolean?,
responseType: String?,
beforeSend: Function?
}
xhr := (XhrOptions, Callback<Response>) => Request
the returned object is either an XMLHttpRequest instance
or an XDomainRequest instance (if on IE8/IE9 &&
options.useXDR is set to true)
Your callback will be called once with the arguments
( Error, response , body ) where the response is an object:
{
body: Object||String,
statusCode: Number,
method: String,
headers: {},
url: String,
rawRequest: xhr
}
body: HTTP response body - XMLHttpRequest.response, XMLHttpRequest.responseText or
XMLHttpRequest.responseXML depending on the request type.rawRequest: Original XMLHttpRequest instance
or XDomainRequest instance (if on IE8/IE9 &&
options.useXDR is set to true)headers: A collection of headers where keys are header names converted to lowercaseYour callback will be called with an Error if there is an error in the browser that prevents sending the request.
A HTTP 500 response is not going to cause an error to be returned.
var req = xhr(url, callback) -
a simple string instead of the options. In this case, a GET request will be made to that url.
var req = xhr(url, options, callback) -
the above may also be called with the standard set of options.
var req = xhr.{post, put, patch, del, head, get}(url, callback)var req = xhr.{post, put, patch, del, head, get}(options, callback)var req = xhr.{post, put, patch, del, head, get}(url, options, callback)The xhr module has convience functions attached that will make requests with the given method.
Each function is named after its method, with the exception of DELETE which is called xhr.del for compatibility.
The method shorthands may be combined with the url-first form of xhr for succinct and descriptive requests. For example,
xhr.post('/post-to-me', function(err, resp) {
console.log(resp.body)
})
or
xhr.del('/delete-me', { headers: { my: 'auth' } }, function (err, resp) {
console.log(resp.statusCode);
})
options.methodSpecify the method the XMLHttpRequest should be opened
with. Passed to XMLHttpRequest.open. Defaults to "GET"
options.useXDRSpecify whether this is a cross origin (CORS) request for IE<10.
Switches IE to use XDomainRequest instead of XMLHttpRequest.
Ignored in other browsers.
Note that headers cannot be set on an XDomainRequest instance.
options.syncSpecify whether this is a synchrounous request. Note that when this is true the callback will be called synchronously. In most cases this option should not be used. Only use if you know what you are doing!
options.bodyPass in body to be send across the XMLHttpRequest.
Generally should be a string. But anything that's valid as
a parameter to XMLHttpRequest.send should work (Buffer for file, etc.).
If options.json is true, then this must be a JSON-serializable object.
options.uri or options.urlThe uri to send a request to. Passed to XMLHttpRequest.open. options.url and options.uri are aliases for each other.
options.headersAn object of headers that should be set on the request. The
key, value pair is passed to XMLHttpRequest.setRequestHeader
options.timeoutNumber of miliseconds to wait for response. Defaults to 0 (no timeout). Ignored when options.sync is true.
options.jsonIf set to true then we serialize the value of options.body and send that as the request body.
We also set the Content-Type to "application/json".
Additionally the response body is parsed as JSON
options.withCredentialsSpecify whether user credentials are to be included in a cross-origin
request. Sets XMLHttpRequest.withCredentials. Defaults to false.
A wildcard * cannot be used in the Access-Control-Allow-Origin header when withCredentials is true.
The header needs to specify your origin explicitly or browser will abort the request.
options.responseTypeDetermines the data type of the response. Sets XMLHttpRequest.responseType. For example, a responseType of document will return a parsed Document object as the response.body for an XML resource.
options.beforeSendA function being called right before the send method of the XMLHttpRequest or XDomainRequest instance is called. The XMLHttpRequest or XDomainRequest instance is passed as an argument.
options.xhrPass an XMLHttpRequest object (or something that acts like one) to use instead of constructing a new one using the XMLHttpRequest or XDomainRequest constructors. Useful for testing.
options.json - you can set it to true on a GET request to tell xhr to parse the response body.options.json body is returned as-is (a string or when responseType is set and the browser supports it - a result of parsing JSON or XML)options.body should be a string or any other value that's valid as
a parameter to XMLHttpRequest.send. Any other value needs to
be serialized before passed to xhr for sending.options.json to true for convenience - then xhr will do the serialization and set content-type accordingly..pipe() etc.
You can override the constructor used to create new requests for testing. When you're making a new request:
xhr({ xhr: new MockXMLHttpRequest() })
or you can override the constructors used to create requests at the module level:
xhr.XMLHttpRequest = MockXMLHttpRequest
xhr.XDomainRequest = MockXDomainRequest
FAQs
small xhr abstraction
We found that @bjoerge/xhr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.