This package provides a robust `XMLHttpRequest` implementation for Node.js environments, specifically designed to extend the original `node-XMLHttpRequest` with critical SSL/TLS configuration options. Currently at version 4.0.0, it addresses the need for finer-grained control over secure connections within a Node.js context, a feature often required by client-side libraries like `engine.io-client` when used on the server. The project acts as a maintained fork, incorporating changes that were not merged into its upstream predecessor. Its key differentiator is the direct exposure of Node.js `https` module options (such as `ca`, `cert`, `key`, `rejectUnauthorized`) via the `XMLHttpRequest` constructor, enabling developers to configure client-side certificates, custom CAs, and other security parameters. This allows for traditional AJAX-style request patterns in Node.js while adhering to specific network security requirements. The release cadence appears to be driven by feature needs and updates related to Node.js's network capabilities.
npm install xmlhttprequest-sslVerified import paths — ran on the pinned version, not inferred.
Demonstrates how to perform a basic GET request and how to utilize the non-standard constructor options for SSL/TLS configuration (e.g., `rejectUnauthorized`) and redirect control, highlighting best practices for security.
Thoroughly test existing code when migrating. Review the `xmlhttprequest-ssl` specific options if SSL/TLS issues arise.
Always aim to use proper `ca`, `cert`, `key`, or `pfx` options to trust specific certificates or CAs. Ensure your Node.js environment has trusted root certificates correctly installed. Set `rejectUnauthorized: true` (default) in production.
Prefer asynchronous requests by setting the third parameter of `xhr.open()` to `true` (default). If synchronous behavior is strictly required, ensure `syncPolicy` is not `"disabled"` and be aware of the performance implications.
Set `allowFileSystemResources: false` if your application does not require `file:` protocol access or if you are handling untrusted URLs. Implement strict URL validation for all requests.
Avoid `disableHeaderCheck: true` unless you have a specific, validated reason. Adhere to standard HTTP practices. If enabled, rigorously sanitize all user-provided header values.
Run `npm install xmlhttprequest-ssl` to ensure the package is installed. Double-check the spelling of the module name in your `require()` or `import` statement.
Correct the import statement to `const { XMLHttpRequest } = require('xmlhttprequest-ssl');` or `var XMLHttpRequest = require('xmlhttprequest-ssl').XMLHttpRequest;` for CommonJS, or `import { XMLHttpRequest } from 'xmlhttprequest-ssl';` for ES Modules.Ensure you are using the correct import syntax for your module type (CJS `require` or ESM `import`) and that the `XMLHttpRequest` symbol is properly destructured or assigned.
If this is a known self-signed certificate for testing, pass `rejectUnauthorized: false` to the `XMLHttpRequest` constructor (with caution). For custom CAs, provide the CA certificate using the `ca` option: `new XMLHttpRequest({ ca: fs.readFileSync('path/to/custom-ca.pem') })`.Ensure that `cert`, `key`, `ca`, and `pfx` options are provided as strings (paths to files) or Buffer objects containing the certificate/key data, as expected by Node.js's `https` module.
No dependency data recorded yet.