Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
fetch-sync
Advanced tools
Proxy fetch requests through the Background Sync API
Made with ❤ at @outlandish
Fetch Sync allows you to proxy fetch requests through the Background Sync API so that they are honoured if made when the UA is offline! Hooray!
Check out a live demo here.
fetchSync.{get,getAll,cancel,cancelAll}()
.importScripts
, or handles SW registration for you.fetch
requests.npm install fetch-sync --save
The library utilises some new technologies so currently only works in some browsers. It definitely works in
Chrome Canary
with the experimental-web-platform-features
flag enabled.
The browser must support:
Chrome Canary | Chrome | Firefox | IE | Opera | Safari |
---|---|---|---|---|---|
✔ | ✔ | ✘ | ✘ | ✘ | ✘ |
Existing Service Worker
If your application already uses a Service Worker, you can import the fetch-sync worker using importScripts
:
importScripts('node_modules/fetch-sync/dist/fetch-sync.sw.min.js')
And then call fetchSync.init()
somewhere in your application's initialisation procedure.
No Service Worker
fetch-sync can handle registration if you don't use a SW already...
Either serve the fetch-sync worker file with a header "Service-Worker-Allowed : /"
, or to avoid configuring headers,
create a Service Worker script in the root of your project and use the method above for 'Existing Service Worker'.
Then see the example under Usage for the fetchSync.init()
method.
Client
// ES6
import fetchSync from 'fetch-sync'
// CommonJS
var fetchSync = require('fetch-sync')
<!-- Script, using minified dist -->
<script src="/node_modules/fetch-sync/dist/fetch-sync.min.js"></script>
Worker
See Initialise for details on importing and registering the service worker.
fetchSync.init([options]) : Promise
Initialise fetchSync.
Look at the documentation for sw-register
available options and for more details on Service Worker registration.
Example:
// Import client lib...
// ES6
import fetchSync from 'fetch-sync'
// ES5
var fetchSync = require('fetch-sync')
<!-- Script, using bundled dist -->
<script src="/node_modules/fetch-sync/dist/fetch-sync.min.js"></script>
// Initialise, passing in worker lib location...
fetchSync.init({
url: 'node_modules/fetch-sync/dist/fetch-sync.sw.js',
scope: '<website address>' // e.g. 'http://localhost:8000'
})
fetchSync([name, ]request[, options]) : Promise<Response>
Perform a sync
Background Sync operation.
Returns a Promise that resolves on success of the fetch request. Rejects if a sync exists with this name already.
If called with a name
:
fetchSync.get('name').then(sync => sync.response)
.sync.remove()
.Examples:
named GET
fetchSync('GetMessages', '/messages')
.then((response) => response.json())
.then((json) => console.log(json.foo))
unnamed POST
const post = fetchSync('/update-profile', {
method: 'POST',
body: { name: '' }
})
// cancel the sync...
post.cancel()
unnamed with options
const headers = new Headers();
headers.append('Authorization', 'Basic abcdefghijklmnopqrstuvwxyz');
// `fetchSync` accepts the same args as `fetch`...
fetchSync('/send-message', { headers })
named with options
fetchSync('/get-messages', { headers })
unnamed with Request
fetchSync(
new Request('/messages')
)
fetchSync.get(name) : Sync
Get a sync by its name.
Returns a Promise that resolves with success of the sync operation or reject if sync operation is not found.
There are also some properties/methods on the Sync. See the Sync API for more details.
Example:
fetchSync('SendMessage', '/message', { body: 'Hello, World!' })
const sync = fetchSync.get('SendMessage')
sync.then((response) => {
if (response.ok) {
alert(`Your message was received at ${new Date(sync.syncedOn).toDateString()}.`
} else {
alert('Message failed to send.')
}
})
fetchSync.getAll() : Array<Sync>
Get all sync operations.
Returns an array of all sync operations (named and unnamed).
Example:
fetchSync.getAll()
.then((syncs) => syncs.forEach(sync => sync.cancel()))
fetchSync.cancel(name) : Promise
Cancel the sync with the given name
.
Example:
fetchSync('Update', '/update', { body })
fetchSync.cancel('Update')
fetchSync.cancelAll() : Promise
Cancel all syncs, named and unnamed.
sync.cancel() : Promise
Cancels the sync operation.
Returns a Promise of success of the cancellation.
Example:
const sync = fetchSync.get('Update')
sync.cancel()
sync.id
The unique ID of the sync operation. This will be its name if it has one.
sync.name
The name of the sync operation if it has one.
sync.createdOn
The time that the sync operation was created.
sync.syncedOn
The time that the sync operation was completed.
sync.cancelled
Is the sync operation cancelled?
As the library depends on Service Workers and no headless browser has (good enough) support for Service Workers that would allow tests to be executed within the console, tests are ran through the browser using Mocha and Chai.
On running npm test
an Express server will be started at localhost:8000
.
Run the tests:
$ cd fetch-sync
$ npm test
The library is bundled by Webpack and transpiled by Babel.
npm install
npm run watch
npm test
http://localhost:8000
All pull requests and issues welcome!
If you're not sure how, check out Kent C. Dodds' great video tutorials on egghead.io!
fetch-sync
was created by Sam Gluck and is released under the MIT license.
FAQs
Proxy fetch requests through the Background Sync API
The npm package fetch-sync receives a total of 15 weekly downloads. As such, fetch-sync popularity was classified as not popular.
We found that fetch-sync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.