
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
transparent-http-compress
Advanced tools
Create a stream based on the `accept-encoding` HTTP header which transparently compresses the data written to it
transparent-http-compress creates a stream based on the accept-encoding HTTP header which transparently compresses the data written to it while being fully compatible to original response
For normal usage, just call httpCompress.compress and use the return value as new response:
const http = require('http');
const httpCompress = require('transparent-http-compress');
http.createServer((request, response) =>
{
let compressedResponse = httpCompress.compress(request, response);
//compressedResponse is connected and fully compatible to the original response
//and can be used as it would be the real response
compressedResponse.setHeader('x-foo', 'bar');
compressedResponse.writeHead(403,
{
'x-bar': 'foo'
}
);
compressedResponse.write('Hello HTTP');
compressedResponse.end();
});
If you want to add new compression libraries or replace or disable existing ones, either set or extend the variable httpCompress.libraries to set the default for all future responses, or pass an object to httpCompress.compress which then will then be merged into the default libraries in httpCompress.libraries for that response:
const http = require('http');
const httpCompress = require('transparent-http-compress');
const myZLib = require('./my-zlib');
//Add/replace the 'deflate' library
httpCompress.libraries.deflate = () => myZLib.createDeflate();
http.createServer((request, response) =>
{
let compressedResponse = httpCompress.compress(request, response,
{
gzip: null, //As this object is merged
//into the default libraries,
//gzip will be disabled for this response
}
);
compressedResponse.write('Hello HTTP');
compressedResponse.end();
});
It's also possible, to pass the Accept-Encoding header manually instead of the whole request object. This also allows to pass a single compression method and if available, that one will be used:
const http = require('http');
const httpCompress = require('transparent-http-compress');
http.createServer((request, response) =>
{
let compressedResponse = httpCompress.compress('deflate, gzip', response);
compressedResponse.write('Hello HTTP');
compressedResponse.end();
});
Following compression methods can be used without any dependencies as they're done using the NodeJS core packages. These are enabled by default:
deflate: Using NodeJS zlibgzip: Using NodeJS zlibbr (brotli): Using NodeJS 11+ zlibSome compression methods are provided by other packages not included in NodeJS. transparent-http-compress doesn't have this dependencies listed in package.json so users don't have to download huge dependency-trees if they don't use the features. If you want to use a compression listed here, just install the dependency and transparent-http-compress will automatically use it.
br (brotli): When below NodeJS 11.7, depends on npm package iltorbcompress(request, response, [additionalLibraries])request (http.IncommingMessage or compatible)response (http.ServerResponse or compatible)additionalLibraries (object) in format { LIBNAME: () => return STREAMINSTANCE };object fully compatible to responseFAQs
Create a stream based on the `accept-encoding` HTTP header which transparently compresses the data written to it
We found that transparent-http-compress demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.