</>PackageGraphPackageGraph

http-signature

npmv1.4.0

Reference implementation of Joyent's HTTP Signature scheme.

Adopt with care

http-signature is usable, with caveats. Last published 1029 days ago.

  • AAdoption: grade A, Excellent.

    19.4M downloads per week and 1 known dependents.

  • DMaintenance: grade D, Poor — a real concern.

    Last published 1029 days ago.

  • BWeight: grade B, Good.

    Pulls in 15 transitive packages, about 751 KB installed (at least — some of the tree is still being crawled).

  • ASupply chain: grade A, Excellent.

    No install scripts, 8 maintainers, and a contained dependency surface.

  • ALicense: grade A, Excellent.

    MIT — permissive, with no copyleft found in the dependency tree.

Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.

Install cost

What you actually take on by adding http-signature to a project.

3
Direct dependencies

Runtime packages this one declares itself.

15
Total installed

Distinct packages in the full runtime tree, deduplicated the way a package manager would.

751 KB
Install size

Unpacked size of this package plus its entire runtime tree.

3
Tree depth

Longest resolved dependency chain below this package.

Part of this dependency tree has not been crawled yet, so these figures are a lower bound rather than a final total.

Licenses in the dependency tree

(AFL-2.1 OR BSD-3-Clause)BSD-3-ClauseMITUnlicense

Every license you inherit by installing http-signature, not just its own. Check this before a legal review, not after.

Compatibility

Node.js
node >=0.10
Module format
CommonJS only
TypeScript
No bundled types
Install scripts
None

Quick start

A usage example from the http-signature README.

jsFull README ↗
var fs = require('fs');
var https = require('https');
var httpSignature = require('http-signature');

var key = fs.readFileSync('./key.pem', 'ascii');

var options = {
  host: 'localhost',
  port: 8443,
  path: '/',
  method: 'GET',
  headers: {}
};
Example truncated — see the full README.

http-signature vs the alternatives

Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.

PackageWeekly downloadsDependentsLicenseLast release
http-signaturethis page19.4M1MIT2 years ago
undici158.5M15MIT1 day ago
@mswjs/interceptors20.3M1MIT1 day ago
pac-proxy-agent01MIT1 day ago
https-proxy-agent225.1M10MIT1 day ago
node-fetch172.9M9MIT1 day ago

Dependencies

Declared by http-signature v1.4.0. Runtime dependencies are installed with the package; dev dependencies are not.

Runtime (3)

assert-plus ^1.0.0jsprim ^2.0.2sshpk ^1.18.0

Dev (2)

tap 0.4.2uuid ^2.0.2

Used by

Popular packages that depend on http-signature.

requestnpm

Simplified HTTP request client.

↓ 12.5M/wk◈ 4 dependents⚖ Apache-2.0deprecated

Relationship graph

Dependencies (left) and dependents (right) of http-signature.

assert-plussshpkjsprimrequesthttp-signature
http-signature dependencies dependents

Frequently installed together

uuidnpm

RFC9562 UUIDs

↓ 254.8M/wk◈ 8 dependents⚖ MITTS
mime-typesnpm

The ultimate javascript content-type utility.

↓ 185.3M/wk◈ 9 dependents⚖ MIT
extendnpm

Port of jQuery.extend for node.js and the browser

↓ 68.3M/wk◈ 2 dependents⚖ MIT
tunnel-agentnpm

HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.

↓ 36.6M/wk◈ 1 dependents⚖ Apache-2.0
json-stringify-safenpm

Like JSON.stringify, but doesn't blow up on circular refs.

↓ 36.4M/wk◈ 1 dependents⚖ ISC
aws4npm

Signs and prepares requests using AWS Signature Version 4

↓ 22.9M/wk◈ 2 dependents⚖ MIT
caselessnpm

Caseless object set/get/has, very useful when working with HTTP headers.

↓ 15.2M/wk◈ 1 dependents⚖ Apache-2.0
aws-sign2npm

AWS signing. Originally pulled from LearnBoost/knox, maintained as vendor in request, now a standalone module.

↓ 14M/wk◈ 1 dependents⚖ Apache-2.0
oauth-signnpm

OAuth 1 signing. Formerly a vendor lib in mikeal/request, now a standalone module.

↓ 12.7M/wk◈ 1 dependents⚖ Apache-2.0
har-validatornpm

Extremely fast HTTP Archive (HAR) validator using JSON Schema

↓ 0/wk◈ 1 dependents⚖ MITdeprecated
form-datanpm

A library to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications.

↓ 0/wk◈ 7 dependents⚖ MITTS
combined-streamnpm

A stream that emits multiple other streams one after another.

↓ 0/wk◈ 2 dependents⚖ MIT

Release history

No releases in the last two years, typically about 86 days apart.

Recent versions of http-signature
VersionPublishedSizeLicense
1.4.0latest2 years ago38 KBMIT
1.3.64 years ago40 KBMIT
1.3.56 years ago40 KBMIT
1.3.46 years ago37 KBMIT
1.3.36 years ago36 KBMIT
1.3.26 years ago34 KBMIT
1.3.16 years ago34 KBMIT
1.3.06 years ago48 KBMIT
1.2.09 years ago—MIT
1.1.110 years ago—MIT
1.1.010 years ago—MIT
1.0.211 years ago—MIT
1.0.111 years ago—MIT
1.0.011 years ago—MIT
0.11.011 years ago—MIT

Overview

http-signature is an npm package that reference implementation of Joyent's HTTP Signature scheme. It is extremely widely used, with about 19.4M downloads per week and 1 known dependents in the graph. The latest version is 1.4.0, released under the MIT license.

Who should use it

Teams working in the npm ecosystem who need reference implementation of Joyent's HTTP Signature scheme and value a battle-tested, widely-adopted solution.

When not to use it

Consider an alternative if you need to have first-class TypeScript types out of the box, or if a more actively-maintained option better fits your npm stack.

Pros

  • Large, well-established user base (19.4M weekly downloads).
  • Clear open-source license (MIT).

Cons

  • No bundled TypeScript types (may require a separate @types package).

Auto-generated from collected registry metadata. No external claims are inferred.

Maintainers

arekinathbahamatkusormcavagemellocmichael.hickspfmooneytodd.whiteman

Keywords

httpsrequest

Frequently asked questions

Should I use http-signature?

http-signature is usable, with caveats. Last published 1029 days ago.

How do I install http-signature?

Run `npm install http-signature` to add http-signature to your npm project.

How many dependencies does http-signature have?

http-signature declares 5 direct dependencies and pulls in 15 packages in total once its runtime tree is resolved totalling about 751 KB on disk.

What license is http-signature released under?

http-signature is distributed under the MIT license. Its dependency tree also includes: (AFL-2.1 OR BSD-3-Clause), BSD-3-Clause, MIT, Unlicense.

How popular is http-signature?

http-signature has approximately 19,387,922 downloads per week and 1 known dependent packages.

Is http-signature still maintained?

The most recent release of http-signature (v1.4.0) was published 2 years ago.

Does http-signature run install scripts?

No. http-signature does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.