url-safe

library2.0.0jsnpmunverified

The `url-safe` package provides a minimalist utility for sanitizing URLs by removing or masking the authentication (username:password) part. This is primarily used to prevent sensitive credentials from being exposed in logs or other less secure outputs. The current stable version is `2.0.0`, which was released on 2015-07-23. The package has seen no further releases or active development since then, indicating it is no longer maintained. Its key differentiator is its singular focus on URL sanitization for logging, leveraging Node.js's built-in `url` module. Developers should be aware of its age and lack of modern updates when considering its use in contemporary projects. Alternatives often involve more robust URL parsing and manipulation libraries or custom regex-based solutions for sensitive data removal.

http-networking auth-security

npm install url-safe

github ↗package ↗

INSTALL

IMPORT

SIG · URL-SAFE

url-safe

http-networkingjavascriptv2.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

urlSafe

✓ const urlSafe = require('url-safe');

✗ import urlSafe from 'url-safe';

This package is CommonJS-only and exports a default function. Direct ESM `import` statements will fail; use dynamic `import()` or CJS `require`.

urlSafe

✓ const { urlSafe } = await import('url-safe');

✗ import { urlSafe } from 'url-safe';

While not explicitly designed for named exports, Node.js's ESM interop allows dynamic import for CommonJS default exports in some configurations, but `require` is the intended usage.

Demonstrates basic usage of `url-safe` to strip or mask the authentication portion of URLs for logging.

const urlSafe = require('url-safe'); const sensitiveUrl1 = 'http://user:pass@example.com/path?query=abc#hash'; const sensitiveUrl2 = 'https://admin:secret@api.service.com/data'; const sensitiveUrl3 = 'ftp://anonymous:ftp@example.org'; console.log('Original URL 1:', sensitiveUrl1); console.log('Safe URL 1 (default):', urlSafe(sensitiveUrl1)); // Expected: http://example.com/path?query=abc#hash console.log('\nOriginal URL 2:', sensitiveUrl2); console.log('Safe URL 2 (masked with ***):', urlSafe(sensitiveUrl2, '***')); // Expected: https://***@api.service.com/data console.log('\nOriginal URL 3:', sensitiveUrl3); console.log('Safe URL 3 (masked with [REDACTED]):', urlSafe(sensitiveUrl3, '[REDACTED]')); // Expected: ftp://[REDACTED]@example.org // Example with no auth part const plainUrl = 'https://www.google.com'; console.log('\nPlain URL:', plainUrl); console.log('Safe Plain URL:', urlSafe(plainUrl)); // Expected: https://www.google.com

Debug

Known issues

breakingStarting with v2.0.0, the returned URL string is consistently formatted using Node.js's `url.format()` function. This may alter the exact string representation compared to previous versions if they used different serialization methods.

fix

Review code that processes the output of `url-safe` to ensure it correctly handles the `url.format()` output, especially regarding path, query, and hash serialization.

affects: >=2.0.0

gotchaThe package is CommonJS-only and has not been updated since 2015. It lacks native ESM support, which may require specific configuration (e.g., dynamic `import()`) or transpilation in modern ESM-first Node.js or browser environments.

fix

For ESM projects, use `const urlSafe = await import('url-safe');` or ensure your build setup correctly handles CJS interop. Alternatively, consider modern alternatives with native ESM support.

affects: >=1.0.0

gotchaGiven its age, the package may not fully leverage or be compatible with newer URL parsing and formatting standards or security practices introduced in more recent Node.js versions or web specifications. The internal `url` module usage might be based on older APIs.

fix

For security-critical applications or those requiring strict adherence to modern URL standards, consider using actively maintained libraries like `URL` (native in Node.js/browsers) or `url-parse` for more robust and current URL manipulation.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: urlSafe is not a function

Attempting to call `urlSafe` when it was not correctly imported or required, potentially due to mixing CJS and ESM without proper interop.

fix

Ensure you are using `const urlSafe = require('url-safe');` for CommonJS projects. If in an ESM context, consider `const { default: urlSafe } = await import('url-safe');` or similar interop patterns, though direct `require` is recommended for this specific package.

ERR_REQUIRE_ESM: Must use import to load ES Module: ...url-safe/index.js

This error is unlikely for `url-safe` itself as it's CJS, but if `url-safe` were treated as ESM by a misconfigured transpiler or an environment forcing ESM interpretation, this could occur.

fix

Verify that `url-safe` is treated as a CommonJS module. If you are experiencing this, it's more likely an issue with your project's configuration for handling CJS modules in an ESM context. Use `require()` directly.

Upgrade

Version history

2.0.0latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

22 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/boennemann/url-safe ↗

packagehttps://www.npmjs.com/package/url-safe ↗