httpntlm is a Node.js library designed to facilitate HTTP NTLM authentication, a protocol used in Windows environments. It is a direct port of the Python `python-ntlm` library and notably includes support for NTLMv2, which handles extended security and target information negotiations. The current stable version is 1.8.13, and while it's a mature library with over a decade of history, its release cadence appears infrequent, with the last significant README update in March 2023. Key differentiators include its focused implementation of NTLM for Node.js, offering both a high-level API for common use cases (GET, POST, etc.) and granular access to NTLM message creation and parsing for advanced scenarios. It supports both HTTP and HTTPS connections, and allows for pre-encrypting passwords for enhanced security. The library relies on other modules like `httpreq`, `async`, and `agentkeepalive` for its underlying HTTP requests and flow control.
npm install httpntlmVerified import paths — ran on the pinned version, not inferred.
Demonstrates how to perform a basic NTLM-authenticated GET request using the library's high-level API, including error handling and using environment variables for sensitive credentials.
Ensure the target server supports NTLMv2. If NTLMv1 is strictly required, manual NTLM message handling via `httpntlm.ntlm` might be necessary, or consider alternative libraries that allow explicit NTLM version specification.
Exercise caution when using in modern Node.js environments. Monitor for compatibility issues and consider alternative, actively maintained NTLM solutions if stability becomes a concern.
For ESM projects, use dynamic `await import('httpntlm')` or ensure your build process correctly transpiles or bundles CJS dependencies. Alternatively, switch your project to CommonJS if `httpntlm` is a critical dependency and ESM is not strictly required.Regularly scan your project's dependencies using tools like Snyk, npm audit, or yarn audit to identify and mitigate any transitive vulnerabilities introduced by `httpntlm` or its components. Update dependencies as recommended.
Verify the URL, username, password, workstation, and domain are correct. Ensure the server endpoint is indeed NTLM-protected and configured correctly. Debug the initial Type 1 message sent to confirm it's well-formed.
Double-check all authentication parameters for typos or incorrect values. Ensure the user account has access to the resource. If pre-encrypting passwords, verify the `lm_password` and `nt_password` buffers are generated correctly from the plaintext password. Consider setting `domain` to an empty string if unsure.
If your project is ESM, either switch to dynamic `await import('httpntlm')` (if supported and appropriate for your use case) or configure your build system to handle CommonJS modules. If possible, consider setting `"type": "commonjs"` in your `package.json` or changing file extensions to `.cjs` for files that use `require()`.