shgysk8zer0 / node-http

A JavaScript library that provides various utilities for working with HTTP

@shgysk8zer0/http

A JavaScript library that provides various utilities for working with HTTP

---

• Code of Conduct
• Contributing

Key Features

• Exported constants for common HTTP status codes, such as ok for 200.
• An extended HTTPError class that inherits from Error.
• Useful polyfills, including an extended File object (derived from Blob) and URL.canParse() for URL validation.
• A set of constants for commonly used Content-Types (from @shgysk8zer0/consts).
• A versatile openLink() function compatible with various JavaScript environments.
• A Cookie class for working with HTTP cookies, enabling easy cookie creation and management.

Warning

Parsing of form data uses regex which has been reported as vulnerable to ReDoS attacks. parseMultipartFormData() is deprecated and will be removed in an upcoming release. Instead, in node > 18 you can use new Request(body, { headers }).formData().

Installation

NPM Installation

npm i @shgysk8zer0/http

NPM Imports

import { HTTPError } from 'shgysk8zer0/http@shgysk8zer0/http/error.js';
import { NOT_IMPLEMENTED, INTERNAL_SERVER_ERROR } from 'shgysk8zer0/http@shgysk8zer0/http/status.js';
import { JSON } from 'shgysk8zer0/http@shgysk8zer0/http/types.js';
import { Cookie } from 'shgysk8zer0/http@shgysk8zer0/http/cookie.js';

Alternative imports

This package is available on unpkg.com as a collection of modules, making it easily accessible for browser-based projects. It is designed to be versatile and is not limited to a specific Node.js environment, ensuring compatibility across various platforms.

import { HTTPError } from 'https://unpkg.com/@shgysk8zer0/http/error.js';
import { NOT_IMPLEMENTED, INTERNAL_SERVER_ERROR } from 'https://unpkg.com/@shgysk8zer0/http/status.js';
import { JSON } from 'https://unpkg.com/@shgysk8zer0/http/types.js';
import { Cookie } from 'https://unpkg.com/@shgysk8zer0/http/cookie.js';

Example Code

export async function handler() {
  try {
    const error = new HTTPError('Not implemented.', {
      status: NOT_IMPLEMENTED,
      cause: new Error('I have not done this yet...'),
    });
    
    throw err;
  } catch (err) {
    if (err instanceof HTTPError) { // Error has an HTTP status & message for use by client
      return Response.json(error, {
        status: error.status,
        headers: new Headers({
          'Content-Type': JSON,
          'Set-Cookie': new Cookie('uid', crypto.randomUUID(), {
            domain: 'example.com',
            path: '/foo',
            maxAge: 86_400_000,
            sameSite: 'Strict',
            httpOnly: true,
            partitioned: true,
          })
        }),
      });  
    } else { // It is not an HTTPError and may contain sensitive into
      return Response.json({
        error: {
          messsage: 'Something broke :(',
          status: INTERNAL_SERVER_ERROR,
        }
      }, { status: INTERNAL_SERVER_ERROR });
    }
  }  
}

node-http's Issues

Fix code scanning alert - Polynomial regular expression used on uncontrolled data

Tracking issue for:

• https://github.com/shgysk8zer0/node-http/security/code-scanning/1

Some regular expressions take a long time to match certain input strings to the point where the time it takes to match a string of length n is proportional to nk or even 2n. Such regular expressions can negatively affect performance, or even allow a malicious user to perform a Denial of Service ("DoS") attack by crafting an expensive input string for the regular expression to match.

The regular expression engines provided by many popular JavaScript platforms use backtracking non-deterministic finite automata to implement regular expression matching. While this approach is space-efficient and allows supporting advanced features like capture groups, it is not time-efficient in general. The worst-case time complexity of such an automaton can be polynomial or even exponential, meaning that for strings of a certain shape, increasing the input length by ten characters may make the automaton about 1000 times slower.