Research
Security News
Malicious PyPI Package ‘pycord-self’ Targets Discord Developers with Token Theft and Backdoor Exploit
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
http2-client
Advanced tools
Drop-in replacement for Nodes http and https that transparently make http request to both http1 / http2 server, it's using the ALPN protocol
Drop-in replacement for Nodes http and https that transparently make http request to both http1 / http2 server. Currently, it's the only http2/https compatible API for clients.
http2 in Node.JS works entirely differently, while in browsers the experience is the same.
http2-client
was created to enable http2 / http1.1 requests with the same interface as http1.1.
The reason is that many NPM modules cannot upgrade to use http2.0 as these are coupled into http1.1 interface.
With http2-client
it should be very straight forward.
Meaning you don't need to know which protocol the destination supports before making the request http2-client
will chose the one that works.
If the Node.js version you are using is not supporting http2 http2-client
will automatically fallback to http.
Transparently supports all http protocol.
In case of http1.1
In case of http2.0
const {request} = require('http2-client');
const h1Target = 'http://www.example.com/';
const h2Target = 'https://www.example.com/';
const req1 = request(h1Target, (res)=>{
console.log(`
Url : ${h1Target}
Status : ${res.statusCode}
HttpVersion : ${res.httpVersion}
`);
});
req1.end();
const req2 = request(h2Target, (res)=>{
console.log(`
Url : ${h2Target}
Status : ${res.statusCode}
HttpVersion : ${res.httpVersion}
`);
});
req2.end();
const {get} = require('http2-client');
const h1Target = 'http://www.example.com/';
const h2Target = 'https://www.example.com/';
get(h1Target, (res)=>{
console.log(`
Url : ${h1Target}
Status : ${res.statusCode}
HttpVersion : ${res.httpVersion}
`);
});
get(h2Target, (res)=>{
console.log(`
Url : ${h2Target}
Status : ${res.statusCode}
HttpVersion : ${res.httpVersion}
`);
});
The module mimics the nodejs http module interface of ClientRequest, get() and request(). Same API as regular http/s modules. Different options will be used depending on the destination this method will get.
By default this module exports a default request method the will try to detect the currect protocol to use (http2/http1.1/https1.1). However, you can always create different request manager with your specfic defaults and seperated cache.
<Object>
<number>
Time to keep http2 connection after used last time. Default: 1000ms.<number>
TTL time for identification results of http1.1. Default: 30000ms.<boolean>
Should enforce http socket.<boolean>
Should enforce https socket.//Use the default
const {request} = require('http2-client');
//Make a request
const req = request(/*....*/);
req.end();
//Alternatively create a new request
const {HttpRequestManager} = require('http2-client');
const httpRequestManager = new HttpRequestManager();
//Make a request
const req = httpRequestManager.request(/*....*/);
req.end();
<Object> | <string> | <URL>
<string>
Protocol to use. Default: 'http:'.<string>
A domain name or IP address of the server to issue the request to. Default: 'localhost'.<string>
Alias for host. To support url.parse(), hostname is preferred over host.<number>
IP address family to use when resolving host and hostname. Valid values are 4 or 6.When unspecified, both IP v4 and v6 will be used.<number>
Port of remote server. Default: 80.<string>
Local interface to bind for network connections.<string>
Unix Domain Socket (use one of host:port or socketPath).<string>
A string specifying the HTTP request method. Default: 'GET'.<string>
Request path. Should include query string if any. E.G. '/index.html?page=12'. An exception is thrown when the request path contains illegal characters. Currently, only spaces are rejected but that may change in the future. Default: '/'.<string>
Basic authentication i.e. 'user:password' to compute an Authorization header.<http.Agent> | <boolean>
Controls Agent behavior. Possible values:
<number>
: A number specifying the socket timeout in milliseconds. This will set the timeout before the socket is connected.<boolean>
: Specifies whether or not to automatically add the Host header. Defaults to true.<Function>
<ClientRequest>
<Object> | <string> | <URL>
Accepts all options from Http/1.1 , with some differences in default values and aditional tls options:
<boolean>
If not false, the server certificate is verified against the list of supplied CAs. An 'error' event is emitted if verification fails; err.code contains the OpenSSL error code. Default: true.<string[]> | <Buffer[]> | <Uint8Array[]> | <Buffer> | <Uint8Array>
An array of strings, Buffers or Uint8Arrays, or a single Buffer or Uint8Array containing the supported ALPN protocols. Buffers should have the format [len][name][len][name]... e.g. 0x05hello0x05world, where the first byte is the length of the next protocol name. Passing an array is usually much simpler, e.g. ['hello', 'world'].<string>
Server name for the SNI (Server Name Indication) TLS extension.<Buffer>
A Buffer instance, containing TLS session.<number>
Minimum size of the DH parameter in bits to accept a TLS connection. When a server offers a DH parameter with a size less than minDHSize, the TLS connection is destroyed and an error is thrown. Default: 1024.<Function>
Custom lookup function. Default: dns.lookup().<Function>
<ClientRequest>
<Object> | <string> | <URL>
Accepts all options from Https/1.1<Function>
<ClientRequest>
http2-client
implements 'Application-Layer Protocol Negotiation (ALPN)'.
Which means it first creates TCP connection, after successful ALPN negotiation the supported protocol is known.
If the supported protocol is http2.0 http2-client
will re-use the same connection.
After the http2.0 connection won't be used for keepH2ConnectionFor
which defaults to 100 ms, it will be automatically closed.
If the supported protocol is http1.x http2-client
will only cache the identification result and not the actual socket for keepH1IdentificationCacheFor
which defaults to 30000 ms.
Any socket configuration is manged by the http agent.
If none is defined the node globalAgent
will be used.
FAQs
Drop-in replacement for Nodes http and https that transparently make http request to both http1 / http2 server, it's using the ALPN protocol
The npm package http2-client receives a total of 1,153,834 weekly downloads. As such, http2-client popularity was classified as popular.
We found that http2-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.