
Security News
Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.
steal-push is server middleware for HTTP2 push. Using steal-tools you can create a bundle manifest that species which modules need to be loaded for each bundle. steal-push uses this manifest file to push files when a given route is used.
steal-push also works with HTTP1 servers, adding a Link header which tells the browser to begin fetching/parsing the assets.
npm install steal-push --save
Before using steal-push you must generate a bundle manifest from steal-tools like so:
stealTools.build(config, {
bundleManifest: true
});
steal-push can be used in plain Node web servers, or in express apps.
const http2 = require("spdy");
const stealPush = require("steal-push");
const pushMain = stealPush("main");
const pushOrders = stealPush("orders");
function app(req, res) {
if(req.url === "/") {
pushMain(req, res);
res.send("<body>Hello world!</body>");
} else {
pushOrders(req, res);
res.send("<body><h1>Orders</h1> ... </body>");
}
}
spdy.createServer({
key: fs.readFileSync("path/to/key.pem"),
cert: fs.readFileSync("path/to/cert.pem"),
spdy: {
protocols: ["h2", "http/1.1"]
}
}, app).listen(8080);
const express = require("express");
const fs = require("fs");
const stealPush = require("steal-push");
const spdy = require("spdy");
const app = express();
const server = spdy.createServer({
key: fs.readFileSync("path/to/key.pem"),
cert: fs.readFileSync("path/to/cert.pem"),
spdy: {
protocols: ["h2", "http/1.1"]
}
}, app);
app.get("/",
stealPush("main"),
function(req, res){
// Resources have already been pushed, just send the html
res.send("<body>Hello world!</body>");
});
app.get("/order/details",
stealPush("orders"),
function(req, res){
res.send("<body><h1>Orders</h1> ... </body>");
});
server.listen(8080);
The StealPush constructor can be used to configure things such as the server root, and the location of the manifest file. Typical usage looks like:
const StealPush = require("steal-push").StealPush;
const stealPush = new StealPush({
manifest: "dist/bundles.json",
root: __dirname + "/assets",
serverRoot: "/app"
});
app.get("/",
stealPush.for("main"),
function(req, res){
...
});
The for() method on the StealPush object is used to create a function that takes a request and response object.
MIT
FAQs
HTTP2 PUSH Support through Steal's bundleManifest
We found that steal-push demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.

Research
/Security News
Campaign of 108 extensions harvests identities, steals sessions, and adds backdoors to browsers, all tied to the same C2 infrastructure.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.