Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
robust-http-fetch
Advanced tools
Redo http fetch request when timeout or failed, aim at providing resilience over plain one-off fetch request by doing retry delayed/failed requests
This robust-http-fetch is a light-weight and 100%-test-coverage javascript util for robustly making http fetch request.
The underlying fetch will be delegated to either window.fetch when use in browser or node-fetch when use in node server side.
It makes request to url endpoint, if response is not arrived in timely manner('init.timeout' settings below) or failed (fragile network etc), it will fire another same request as backup(up to 'init.maxRequests' requests to fire if none of them are happily resolved). It waits upto 'init.timeout' millisecond for response, if more than one requests are in-flight, the earliest resolved one will be resolved with and returned. Details refer to usage section in this page
Caveat: only use this utils when your request is idempotent, for example GET, no matter how many times calling GET, should have same result and data integrity still maintained. as well as DELETE. In case of POST/PUT, make sure your server side(or rely on DB constraints etc) to maintain the integrity, for example backend to perform checking if previous requests have completed then abort duplicated requests etc.
Use the package manager npm to install robust-http-fetch.
npm install robust-http-fetch
Usage is as simple as below, can also refer to tests in End2End tests or unit tests)
const { robustHttpFetch } = require('robust-http-fetch');
const apiUrl = "https://postman-echo.com/post";
const body = {hello: 'world'};
//Here use the Promise resolve callback function as the callback in 3rd parameter, but you can use any function as callback to fit yourself
const resultAsPromise = new Promise((resolve, reject) => {
robustHttpFetch(
apiUrl, // required, request url
{
timeout: 3000, // required, ie. here request will wait 1500ms before firing another request
maxRequests: 3, // required, ie. here upto 3 requests to fire in case previous requests delayed or not resolved happily
method: 'POST',
body: JSON.stringify(body),
headers: {'Content-Type': 'application/json'}
},
resolve, // required, callback function to be invoked with a Promise object later
console.log // optional function
);
});
//Do your stuff with this promise as usual, for example
resultAsPromise
.then(res => res.json())
.then(data => console.log(data));
Arguments:
const {robustHttpFetch} = require('robust-http-fetch')
is a javascript function to use, which accept 4 parameters as following
Parameter | Required | Type | Description |
---|---|---|---|
url | true | string | The resource destination url to make this request to |
init | true | object | It can have properties in 'init' parameter of window.fetch or 'options' parameter of node-fetch. however two settings are MANDATORY: 'timeout' to time-box a request and 'maxRequests' to limit the total number of requests to attempt. other properties refer to 'init' of window.fetch or 'options' of node-fetch |
callback | true | function | It will be invoked with a resolved promise(if a request is well finished before attempting all the retry requests) or last request' result(a promise that might be eventually resolved or rejected) |
optLogger | false | function | Optional, if any, will get called with a single string parameter to give small hints when making request |
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
Please make sure to update tests as appropriate.
FAQs
Redo the http request when timeout or failed, aim at providing resilience over plain one-off fetch request by doing retry delayed/failed requests
The npm package robust-http-fetch receives a total of 6 weekly downloads. As such, robust-http-fetch popularity was classified as not popular.
We found that robust-http-fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.