http-proxy-middleware
Advanced tools
The one-liner node.js proxy middleware for connect, express and browser-sync
The http-proxy-middleware package is a Node.js package that provides an HTTP proxy as a middleware for use with Node.js applications, particularly in conjunction with frameworks like Express. It allows developers to easily set up proxy rules to forward requests to other servers, which is useful for tasks like API forwarding, logging, handling CORS, and more.
Proxy requests
This feature allows you to proxy requests to another server. In this example, all requests to '/api' on the local server are forwarded to 'http://www.example.org'.
const { createProxyMiddleware } = require('http-proxy-middleware');
const apiProxy = createProxyMiddleware('/api', { target: 'http://www.example.org' });
app.use('/api', apiProxy);Path Rewriting
This feature allows you to rewrite the path of the request URL before it gets proxied. In this example, the path '/api' is removed before the request is forwarded to 'http://www.example.org'.
const { createProxyMiddleware } = require('http-proxy-middleware');
const apiProxy = createProxyMiddleware('/api', {
target: 'http://www.example.org',
pathRewrite: { '^/api': '' }
});
app.use('/api', apiProxy);Custom Routing Logic
This feature allows you to implement custom routing logic. In this example, only GET requests to paths starting with '/api' are proxied to 'http://www.example.org'.
const { createProxyMiddleware } = require('http-proxy-middleware');
const apiProxy = createProxyMiddleware((pathname, req) => {
return pathname.match('^/api') && req.method === 'GET';
}, { target: 'http://www.example.org' });
app.use(apiProxy);Handling WebSockets
This feature allows you to proxy WebSocket connections. In this example, WebSocket connections to '/socket' are proxied to 'ws://www.example.org'.
const { createProxyMiddleware } = require('http-proxy-middleware');
const wsProxy = createProxyMiddleware('/socket', {
target: 'ws://www.example.org',
ws: true
});
app.use('/socket', wsProxy);express-http-proxy is similar to http-proxy-middleware but is specifically designed for use with Express. It offers similar features for proxying HTTP requests but may have different configuration options and middleware setup.
node-http-proxy is a full-featured HTTP proxy library for Node.js, which http-proxy-middleware is built upon. It provides more low-level control over proxying but requires more setup compared to the convenience middleware layer provided by http-proxy-middleware.
Redbird is a reverse proxy library for Node.js with built-in support for clustering, HTTP2, LetsEncrypt, and more. It is more feature-rich and suitable for more complex proxying needs compared to http-proxy-middleware, which is simpler and more focused on middleware use cases.
Node.js proxying made simple. Configure proxy middleware with ease for connect, express, browser-sync and many more.
Powered by the popular Nodejitsu http-proxy. 
This page is showing documentation for version v2.x.x (release notes)
If you're looking for v0.x documentation. Go to: https://github.com/chimurai/http-proxy-middleware/tree/v0.21.0#readme
Proxy /api requests to http://www.example.org
// javascript
const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');
const app = express();
app.use('/api', createProxyMiddleware({ target: 'http://www.example.org', changeOrigin: true }));
app.listen(3000);
// http://localhost:3000/api/foo/bar -> http://www.example.org/api/foo/bar
// typescript
import * as express from 'express';
import { createProxyMiddleware, Filter, Options, RequestHandler } from 'http-proxy-middleware';
const app = express();
app.use('/api', createProxyMiddleware({ target: 'http://www.example.org', changeOrigin: true }));
app.listen(3000);
// http://localhost:3000/api/foo/bar -> http://www.example.org/api/foo/bar
All http-proxy options can be used, along with some extra http-proxy-middleware options.
:bulb: Tip: Set the option changeOrigin to true for name-based virtual hosted sites.
$ npm install --save-dev http-proxy-middleware
Proxy middleware configuration.
const { createProxyMiddleware } = require('http-proxy-middleware');
const apiProxy = createProxyMiddleware('/api', { target: 'http://www.example.org' });
// \____/ \_____________________________/
// | |
// context options
// 'apiProxy' is now ready to be used as middleware in a server.
(full list of http-proxy-middleware configuration options)
// shorthand syntax for the example above:
const apiProxy = createProxyMiddleware('http://www.example.org/api');
More about the shorthand configuration.
An example with express server.
// include dependencies
const express = require('express');
const { createProxyMiddleware } = require('http-proxy-middleware');
// proxy middleware options
/** @type {import('http-proxy-middleware/dist/types').Options} */
const options = {
target: 'http://www.example.org', // target host
changeOrigin: true, // needed for virtual hosted sites
ws: true, // proxy websockets
pathRewrite: {
'^/api/old-path': '/api/new-path', // rewrite path
'^/api/remove/path': '/path', // remove base path
},
router: {
// when request.headers.host == 'dev.localhost:3000',
// override target 'http://www.example.org' to 'http://localhost:8000'
'dev.localhost:3000': 'http://localhost:8000',
},
};
// create the proxy (without context)
const exampleProxy = createProxyMiddleware(options);
// mount `exampleProxy` in web server
const app = express();
app.use('/api', exampleProxy);
app.listen(3000);
Providing an alternative way to decide which requests should be proxied; In case you are not able to use the server's path parameter to mount the proxy or when you need more flexibility.
RFC 3986 path is used for context matching.
foo://example.com:8042/over/there?name=ferret#nose
\_/ \______________/\_________/ \_________/ \__/
| | | | |
scheme authority path query fragment
path matching
createProxyMiddleware({...}) - matches any path, all requests will be proxied.createProxyMiddleware('/', {...}) - matches any path, all requests will be proxied.createProxyMiddleware('/api', {...}) - matches paths starting with /apimultiple path matching
createProxyMiddleware(['/api', '/ajax', '/someotherpath'], {...})wildcard path matching
For fine-grained control you can use wildcard matching. Glob pattern matching is done by micromatch. Visit micromatch or glob for more globbing examples.
createProxyMiddleware('**', {...}) matches any path, all requests will be proxied.createProxyMiddleware('**/*.html', {...}) matches any path which ends with .htmlcreateProxyMiddleware('/*.html', {...}) matches paths directly under path-absolutecreateProxyMiddleware('/api/**/*.html', {...}) matches requests ending with .html in the path of /apicreateProxyMiddleware(['/api/**', '/ajax/**'], {...}) combine multiple patternscreateProxyMiddleware(['/api/**', '!**/bad.json'], {...}) exclusionNote: In multiple path matching, you cannot use string paths and wildcard paths together.
custom matching
For full control you can provide a custom function to determine which requests should be proxied or not.
/**
* @return {Boolean}
*/
const filter = function (pathname, req) {
return pathname.match('^/api') && req.method === 'GET';
};
const apiProxy = createProxyMiddleware(filter, {
target: 'http://www.example.org',
});
option.pathRewrite: object/function, rewrite target's url path. Object-keys will be used as RegExp to match paths.
// rewrite path
pathRewrite: {'^/old/api' : '/new/api'}
// remove path
pathRewrite: {'^/remove/api' : ''}
// add base path
pathRewrite: {'^/' : '/basepath/'}
// custom rewriting
pathRewrite: function (path, req) { return path.replace('/api', '/base/api') }
// custom rewriting, returning Promise
pathRewrite: async function (path, req) {
const should_add_something = await httpRequestToDecideSomething(path);
if (should_add_something) path += "something";
return path;
}
option.router: object/function, re-target option.target for specific requests.
// Use `host` and/or `path` to match requests. First match will be used.
// The order of the configuration matters.
router: {
'integration.localhost:3000' : 'http://localhost:8001', // host only
'staging.localhost:3000' : 'http://localhost:8002', // host only
'localhost:3000/api' : 'http://localhost:8003', // host + path
'/rest' : 'http://localhost:8004' // path only
}
// Custom router function (string target)
router: function(req) {
return 'http://localhost:8004';
}
// Custom router function (target object)
router: function(req) {
return {
protocol: 'https:', // The : is required
host: 'localhost',
port: 8004
};
}
// Asynchronous router function which returns promise
router: async function(req) {
const url = await doSomeIO();
return url;
}
option.logLevel: string, ['debug', 'info', 'warn', 'error', 'silent']. Default: 'info'
option.logProvider: function, modify or replace log provider. Default: console.
// simple replace
function logProvider(provider) {
// replace the default console log provider.
return require('winston');
}
// verbose replacement
function logProvider(provider) {
const logger = new (require('winston').Logger)();
const myCustomProvider = {
log: logger.log,
debug: logger.debug,
info: logger.info,
warn: logger.warn,
error: logger.error,
};
return myCustomProvider;
}
Subscribe to http-proxy events:
option.onError: function, subscribe to http-proxy's error event for custom error handling.
function onError(err, req, res, target) {
res.writeHead(500, {
'Content-Type': 'text/plain',
});
res.end('Something went wrong. And we are reporting a custom error message.');
}
option.onProxyRes: function, subscribe to http-proxy's proxyRes event.
function onProxyRes(proxyRes, req, res) {
proxyRes.headers['x-added'] = 'foobar'; // add new header to response
delete proxyRes.headers['x-removed']; // remove header from response
}
option.onProxyReq: function, subscribe to http-proxy's proxyReq event.
function onProxyReq(proxyReq, req, res) {
// add custom header to request
proxyReq.setHeader('x-added', 'foobar');
// or log the req
}
option.onProxyReqWs: function, subscribe to http-proxy's proxyReqWs event.
function onProxyReqWs(proxyReq, req, socket, options, head) {
// add custom header
proxyReq.setHeader('X-Special-Proxy-Header', 'foobar');
}
option.onOpen: function, subscribe to http-proxy's open event.
function onOpen(proxySocket) {
// listen for messages coming FROM the target here
proxySocket.on('data', hybridParseAndLogMessage);
}
option.onClose: function, subscribe to http-proxy's close event.
function onClose(res, socket, head) {
// view disconnected websocket connections
console.log('Client disconnected');
}
The following options are provided by the underlying http-proxy library.
option.target: url string to be parsed with the url module
option.forward: url string to be parsed with the url module
option.agent: object to be passed to http(s).request (see Node's https agent and http agent objects)
option.ssl: object to be passed to https.createServer()
option.ws: true/false: if you want to proxy websockets
option.xfwd: true/false, adds x-forward headers
option.secure: true/false, if you want to verify the SSL Certs
option.toProxy: true/false, passes the absolute URL as the path (useful for proxying to proxies)
option.prependPath: true/false, Default: true - specify whether you want to prepend the target's path to the proxy path
option.ignorePath: true/false, Default: false - specify whether you want to ignore the proxy path of the incoming request (note: you will have to append / manually if required).
option.localAddress : Local interface string to bind for outgoing connections
option.changeOrigin: true/false, Default: false - changes the origin of the host header to the target URL
option.preserveHeaderKeyCase: true/false, Default: false - specify whether you want to keep letter case of response header key
option.auth : Basic authentication i.e. 'user:password' to compute an Authorization header.
option.hostRewrite: rewrites the location hostname on (301/302/307/308) redirects.
option.autoRewrite: rewrites the location host/port on (301/302/307/308) redirects based on requested host/port. Default: false.
option.protocolRewrite: rewrites the location protocol on (301/302/307/308) redirects to 'http' or 'https'. Default: null.
option.cookieDomainRewrite: rewrites domain of set-cookie headers. Possible values:
false (default): disable cookie rewritingcookieDomainRewrite: "new.domain". To remove the domain, use cookieDomainRewrite: ""."*" to match all domains.cookieDomainRewrite: {
"unchanged.domain": "unchanged.domain",
"old.domain": "new.domain",
"*": ""
}
option.cookiePathRewrite: rewrites path of set-cookie headers. Possible values:
false (default): disable cookie rewritingcookiePathRewrite: "/newPath/". To remove the path, use cookiePathRewrite: "". To set path to root use cookiePathRewrite: "/"."*" to match all paths.
For example, to keep one path unchanged, rewrite one path and remove other paths:
cookiePathRewrite: {
"/unchanged.path/": "/unchanged.path/",
"/old.path/": "/new.path/",
"*": ""
}
option.headers: object, adds request headers. (Example: {host:'www.example.org'})
option.proxyTimeout: timeout (in millis) when proxy receives no response from target
option.timeout: timeout (in millis) for incoming requests
option.followRedirects: true/false, Default: false - specify whether you want to follow redirects
option.selfHandleResponse true/false, if set to true, none of the webOutgoing passes are called and it's your responsibility to appropriately return the response by listening and acting on the proxyRes event
option.buffer: stream of data to send as the request body. Maybe you have some middleware that consumes the request stream before proxying it on e.g. If you read the body of a request into a field called 'req.rawbody' you could restream this field in the buffer option:
'use strict';
const streamify = require('stream-array');
const HttpProxy = require('http-proxy');
const proxy = new HttpProxy();
module.exports = (req, res, next) => {
proxy.web(
req,
res,
{
target: 'http://localhost:4003/',
buffer: streamify(req.rawBody),
},
next
);
};
Use the shorthand syntax when verbose configuration is not needed. The context and option.target will be automatically configured when shorthand is used. Options can still be used if needed.
createProxyMiddleware('http://www.example.org:8000/api');
// createProxyMiddleware('/api', {target: 'http://www.example.org:8000'});
createProxyMiddleware('http://www.example.org:8000/api/books/*/**.json');
// createProxyMiddleware('/api/books/*/**.json', {target: 'http://www.example.org:8000'});
createProxyMiddleware('http://www.example.org:8000/api', { changeOrigin: true });
// createProxyMiddleware('/api', {target: 'http://www.example.org:8000', changeOrigin: true});
If you want to use the server's app.use path parameter to match requests;
Create and mount the proxy without the http-proxy-middleware context parameter:
app.use('/api', createProxyMiddleware({ target: 'http://www.example.org', changeOrigin: true }));
app.use documentation:
// verbose api
createProxyMiddleware('/', { target: 'http://echo.websocket.org', ws: true });
// shorthand
createProxyMiddleware('http://echo.websocket.org', { ws: true });
// shorter shorthand
createProxyMiddleware('ws://echo.websocket.org');
In the previous WebSocket examples, http-proxy-middleware relies on a initial http request in order to listen to the http upgrade event. If you need to proxy WebSockets without the initial http request, you can subscribe to the server's http upgrade event manually.
const wsProxy = createProxyMiddleware('ws://echo.websocket.org', { changeOrigin: true });
const app = express();
app.use(wsProxy);
const server = app.listen(3000);
server.on('upgrade', wsProxy.upgrade); // <-- subscribe to http 'upgrade'
Intercept requests from downstream by defining onProxyReq in createProxyMiddleware.
Currently the only pre-provided request interceptor is fixRequestBody, which is used to fix proxied POST requests when bodyParser is applied before this middleware.
Example:
const { createProxyMiddleware, fixRequestBody } = require('http-proxy-middleware');
const proxy = createProxyMiddleware({
/**
* Fix bodyParser
**/
onProxyReq: fixRequestBody,
});
Intercept responses from upstream with responseInterceptor. (Make sure to set selfHandleResponse: true)
Responses which are compressed with brotli, gzip and deflate will be decompressed automatically. The response will be returned as buffer (docs) which you can manipulate.
With buffer, response manipulation is not limited to text responses (html/css/js, etc...); image manipulation will be possible too. (example)
NOTE: responseInterceptor disables streaming of target's response.
Example:
const { createProxyMiddleware, responseInterceptor } = require('http-proxy-middleware');
const proxy = createProxyMiddleware({
/**
* IMPORTANT: avoid res.end being called automatically
**/
selfHandleResponse: true, // res.end() will be called internally by responseInterceptor()
/**
* Intercept response and replace 'Hello' with 'Goodbye'
**/
onProxyRes: responseInterceptor(async (responseBuffer, proxyRes, req, res) => {
const response = responseBuffer.toString('utf8'); // convert buffer to string
return response.replace('Hello', 'Goodbye'); // manipulate response and return the result
}),
});
Check out interception recipes for more examples.
View and play around with working examples.
View the recipes for common use cases.
http-proxy-middleware is compatible with the following servers:
Sample implementations can be found in the server recipes.
Run the test suite:
# install dependencies
$ yarn
# linting
$ yarn lint
$ yarn lint:fix
# building (compile typescript to js)
$ yarn build
# unit tests
$ yarn test
# code coverage
$ yarn cover
# check spelling mistakes
$ yarn spellcheck
The MIT License (MIT)
Copyright (c) 2015-2022 Steven Chim
FAQs
The one-liner node.js proxy middleware for connect, express, next.js and more
The npm package http-proxy-middleware receives a total of 9,886,410 weekly downloads. As such, http-proxy-middleware popularity was classified as popular.
We found that http-proxy-middleware demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.
Security News
Research
Socket's threat research team has detected five malicious npm packages targeting Roblox developers, deploying malware to steal credentials and personal data.