
Research
/Security News
Malicious npm Packages Target WhatsApp Developers with Remote Kill Switch
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Mockttp is a versatile HTTP mocking library for Node.js, designed to help developers test HTTP-based applications by simulating HTTP servers and requests. It allows you to create mock servers, define request handlers, and verify interactions, making it easier to test how your application handles different HTTP scenarios.
Create a mock server
This feature allows you to create and start a local mock server on a specified port. The code sample demonstrates how to start a mock server on port 8080 and log its URL.
const { getLocal } = require('mockttp');
(async () => {
const mockServer = getLocal();
await mockServer.start(8080);
console.log(`Mock server running at ${mockServer.url}`);
})();
Mock HTTP requests
This feature allows you to define how the mock server should respond to specific HTTP requests. The code sample shows how to mock a GET request to '/example' and respond with a 200 status and 'Hello, world!' message.
const { getLocal } = require('mockttp');
(async () => {
const mockServer = getLocal();
await mockServer.start(8080);
await mockServer.forGet('/example').thenReply(200, 'Hello, world!');
})();
Verify request interactions
This feature allows you to verify that certain requests were made to the mock server. The code sample demonstrates how to check the number of times a mocked endpoint was accessed.
const { getLocal } = require('mockttp');
(async () => {
const mockServer = getLocal();
await mockServer.start(8080);
const endpointMock = await mockServer.forGet('/example').thenReply(200, 'Hello, world!');
// Later, verify the request was made
const requests = await endpointMock.getSeenRequests();
console.log(`Number of requests made: ${requests.length}`);
})();
Nock is a popular HTTP mocking library for Node.js that intercepts HTTP requests and allows you to define custom responses. Unlike Mockttp, which creates a mock server, Nock works by intercepting requests at the network level, making it more suitable for unit tests where you don't want to start an actual server.
http-server-mock is a lightweight HTTP server mock library that allows you to create mock servers and define request handlers. It is similar to Mockttp in that it creates a server, but it is generally simpler and may not offer as many features for complex testing scenarios.
WireMock is a flexible HTTP mocking tool that can be used for testing HTTP clients. It is more feature-rich and can be used both as a standalone server and embedded in Java applications. While Mockttp is focused on Node.js, WireMock is a more general-purpose tool with a broader range of features.
Part of HTTP Toolkit: powerful tools for building, testing & debugging HTTP(S)
Mockttp lets you intercept, transform or test HTTP requests & responses in JavaScript - quickly, reliably & anywhere.
You can use Mockttp for integration testing, by intercepting real requests as part of your test suite, or you can use Mockttp to build custom HTTP proxies that capture, inspect and/or rewrite HTTP in any other kind of way you like.
HTTP testing is the most common and well supported use case. There's a lot of tools to test HTTP, but typically by stubbing the HTTP functions in-process at the JS level. That ties you to a specific environment, doesn't truly test the real requests that you code would send, and only works for requests made in the same JS process. It's inflexible, limiting and inaccurate, and often unreliable & tricky to debug too.
Mockttp meanwhile allows you to do accurate true integration testing, writing one set of tests that works out of the box in node or browsers, with support for transparent proxying & HTTPS, strong typing & promises throughout, fast & safe parallel testing, and with debuggability built-in at every stage.
Mockttp is also battle-tested as a scriptable rewriting proxy, powering all the HTTP internals of HTTP Toolkit. Anything you can do with HTTP Toolkit, you can automate with Mockttp as a headless script.
Let's get specific. Mockttp lets you:
npm install --save-dev mockttp
To run an HTTP integration test, you need to:
Here's a simple minimal example of all that using plain promises, Mocha, Chai & Superagent, which works out of the box in Node and modern browsers:
const superagent = require("superagent");
const mockServer = require("mockttp").getLocal();
describe("Mockttp", () => {
// Start your mock server
beforeEach(() => mockServer.start(8080));
afterEach(() => mockServer.stop());
it("lets you mock requests, and assert on the results", async () => {
// Mock your endpoints
await mockServer.forGet("/mocked-path").thenReply(200, "A mocked response");
// Make a request
const response = await superagent.get("http://localhost:8080/mocked-path");
// Assert on the results
expect(response.text).to.equal("A mocked response");
});
});
That is pretty easy, but we can make this simpler & more powerful. Let's take a look at some more fancy features:
const superagent = require("superagent");
require('superagent-proxy')(superagent);
const mockServer = require("mockttp").getLocal();
describe("Mockttp", () => {
// Note that there's no start port here, so we dynamically find a free one instead
beforeEach(() => mockServer.start());
afterEach(() => mockServer.stop());
it("lets you mock without specifying a port, allowing parallel testing", async () => {
await mockServer.forGet("/mocked-endpoint").thenReply(200, "Tip top testing");
// Try mockServer.url or .urlFor(path) to get a the dynamic URL for the server's port
let response = await superagent.get(mockServer.urlFor("/mocked-endpoint"));
expect(response.text).to.equal("Tip top testing");
});
it("lets you verify the request details the mockttp server receives", async () => {
const endpointMock = await mockServer.forGet("/mocked-endpoint").thenReply(200, "hmm?");
await superagent.get(mockServer.urlFor("/mocked-endpoint"));
// Inspect the mock to get the requests it received and assert on their details
const requests = await endpointMock.getSeenRequests();
expect(requests.length).to.equal(1);
expect(requests[0].url).to.equal(`http://localhost:${mockServer.port}/mocked-endpoint`);
});
it("lets you proxy requests made to any other hosts", async () => {
// Match a full URL instead of just a path to mock proxied requests
await mockServer.forGet("http://google.com").thenReply(200, "I can't believe it's not google!");
// One of the many ways to use a proxy - this assumes Node & superagent-proxy.
// In a browser, you can simply use the browser settings instead.
let response = await superagent.get("http://google.com").proxy(mockServer.url);
expect(response.text).to.equal("I can't believe it's not google!");
});
});
These examples use Mocha, Chai and Superagent, but none of those are required: Mockttp will work with any testing tools that can handle promises (and with minor tweaks, many that can't), and can mock requests from any library, tool or device you might care to use.
FAQs
Mock HTTP server for testing HTTP clients and stubbing webservices
We found that mockttp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.