Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
A lightweight HTTP framework for Typescript / JS, with zero dependencies
npm install --save http4js
An example server and client
//define our routes
const routing = routes('GET', ".*", async (req: Req) => {
console.log(req);
return ResOf(Status.OK, 'OK');
})
//add csrf token header to every request and vary gzip to every response
const headerFilter = (handler: HttpHandler) => {
return asHandler(async (req: Req) => {
const response = await handler(req.withHeader(Headers.X_CSRF_TOKEN, Math.random()))
return response.withHeader(Headers.VARY, "gzip");
})
};
// start routing as a NativeHttpServer on port 3000
routing
.withFilter(headerFilter)
.asServer(HttpServer(3000))
.start();
// make an http request to a server and log the response
HttpClient(ReqOf(Method.GET, "http://httpbin.org/get")).then(res => console.log(res))
// make an http or https request and log the response
const client = new HttpClientHandler()
client.handle(ReqOf(Method.GET, "http://httpbin.org/get")).then(res => console.log(res))
client.handle(ReqOf(Method.GET, "https://httpbin.org/get")).then(res => console.log(res))
fix HttpsClient: post body
res.fullBodyString() for bodies > 65kb
Filters.GZIP(HttpClient)
or .withFilter(Filters.GZIP)
serveE2E
To find a matching handler for a Req
, we recurse "left to right and deepest
first" through nested routes, ie. routes attached to top level routes
using withRoutes(routes)
, ending finally with the top level routes e.g.
get('/', async()=> ResOf())
.withRoutes(
routes.withRoutes(furtherNestedRoutes)
)
furtherNestedRoutes
is traversed followed by routes
then finally the top
level routes.
Further docs here
Redirect
is now a static method Res.Redirect
as we provide a number of
convenience methods eg. Res.OK()
and Res.GatewayTimeout
.
We provide HttpServer(3000)
and HttpsServer(3000, certs)
as quick easy ways to provide a server.
See streaming docs for more info
NativeHttpServer
and HttpClient
stream in and out by default. A handle on
the stream is provided by req.bodyStream()
and a res
is streamed out if
a Res(200, readable)
is provided, i.e. a Readable
stream body.
In order to evolve the core library faster support for Express and Koa backends has been dropped. Happy to add back later.
I'd be very happy if you'd like to contribute :)
git clone git@github.com:TomShacham/http4js.git && \
cd http4js && \
npm i --save && \
./create-ssl-certs.sh && \
npm test
http4js is a port of http4k.
Early ideas and influence from Daniel Bodart's Utterly Idle
We need our own certs to run an HTTPS server locally.
These Commands get you most of the way, I altered them slightly for this script, that may work for you
./create-ssl-certs.sh
If not, follow these Instructions to create your own certificates in order to run an HTTPS server locally.
Then run
npm test
Create a big file
cat /dev/urandom | base64 >> bigfile.txt
# wait ...
# ^C
Start up a server and stream the file
get('/bigfile', async() => ResOf(200, fs.createReadStream('./bigfile.txt')))
.asServer()
.start();
Check the memory of usage of the process.
FAQs
A lightweight HTTP toolkit
The npm package http4js receives a total of 455 weekly downloads. As such, http4js popularity was classified as not popular.
We found that http4js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.