safe-fetch

library0.2.1jsnpmunverified

A fetch() wrapper that implements Double Submit Cookies CSRF protection. Version 0.2.1 is the current release, last updated in 2015. It automatically adds a CSRF token header (default x-csrf-token) from a cookie (default csrf-token) for same-origin requests. The library sets credentials: 'same-origin' by default and can be configured via global properties. It requires a server that sets the CSRF cookie and expects the header. This package is minimal and unmaintained, with no TypeScript definitions and limited browser support (requires native fetch or polyfill). It is designed for simple CSRF prevention in fetch-based web applications.

security

npm install safe-fetch

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SAFE-FETCH

safe-fetch

securityjavascriptv0.2.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

fetch

✓ import fetch from 'safe-fetch'

✗ const fetch = require('safe-fetch')

The module uses default export. Named export is not available.

cookieName and headerName configuration

✓ import fetch from 'safe-fetch'; fetch.cookieName = 'my-cookie'; fetch.headerName = 'x-my-header';

✗ require('safe-fetch').default.cookieName = 'my-cookie';

Global configuration is done by modifying properties on the imported fetch function.

usage of fetch with options

✓ import fetch from 'safe-fetch'; fetch('/url', { credentials: 'include' }).then(...)

✗ import { fetch } from 'safe-fetch';

There is no named export 'fetch'; only default export.

Shows basic usage with POST request including credentials and CSRF protection.

import fetch from 'safe-fetch'; fetch('/api/data', { method: 'POST', credentials: 'include', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ key: 'value' }) }) .then(response => response.json()) .then(data => console.log(data)) .catch(error => console.error('Fetch error:', error));

Debug

Known issues

gotchaUsing credentials: 'omit' or not setting credentials will skip setting the CSRF header.

fix

Set credentials to 'same-origin' (default) or 'include' to ensure CSRF header is sent.

affects: >=0.0.0

gotchaThe library changes the global fetch function when imported; you cannot use native fetch directly afterwards.

fix

Either import safe-fetch as a replacement for fetch or use native fetch via window.fetch before importing safe-fetch.

affects: >=0.0.0

deprecatedPackage has not been updated since 2015; likely incompatible with modern fetch API changes.

fix

Consider using a maintained alternative or implement CSRF protection manually.

affects: >=0.0.0

gotchaThe cookie name or header name global properties are shared across all requests; changing them affects all subsequent requests.

fix

Set cookieName and headerName before making any fetch calls or reset them after use.

affects: >=0.0.0

Errors

Common errors & fixes

TypeError: fetch is not a function

Importing the module without a fetch polyfill in a non-browser environment (e.g., Node.js) or not using default import correctly.

fix

Use a polyfill like 'whatwg-fetch' before importing safe-fetch, or import with 'import fetch from 'safe-fetch'' (not named import).

Error: CSRF token not found in cookie

The server did not set the cookie named 'csrf-token' (default) or the cookie is not accessible due to same-origin policy.

fix

Ensure the server sets a cookie with the expected name and that credentials are set to 'same-origin' or 'include' in the request.

Uncaught ReferenceError: fetch is not defined

Running in an environment without global fetch (e.g., older browsers or Node.js) and no polyfill loaded.

fix

Install a fetch polyfill (e.g., 'whatwg-fetch') and import it before safe-fetch.

Upgrade

Version history

0.2.1latest on npm

Audit

Dependencies

whatwg-fetchoptionalneeded as a polyfill in environments without native fetch

Agent activity

16 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubssh://git@github.com/grassator/safe-fetch ↗

packagesafe-fetch ↗

homepagehttps://github.com/grassator/safe-fetch#readme ↗