http-signature
npmv1.4.0Reference implementation of Joyent's HTTP Signature scheme.
Adopt with care
http-signature is usable, with caveats. Last published 980 days ago.
- ?Adoption: grade ?, Not reported by this registry.
No download data reported for this package yet.
- DMaintenance: grade D, Poor — a real concern.
Last published 980 days ago.
- AWeight: grade A, Excellent.
Pulls in 4 transitive packages, about 335 KB installed.
- ASupply chain: grade A, Excellent.
No install scripts, 8 maintainers, and a contained dependency surface.
- ALicense: grade A, Excellent.
MIT — permissive, with no copyleft found in the dependency tree.
Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.
Install cost
What you actually take on by adding http-signature to a project.
Runtime packages this one declares itself.
Distinct packages in the full runtime tree, deduplicated the way a package manager would.
Unpacked size of this package plus its entire runtime tree.
Longest resolved dependency chain below this package.
Licenses in the dependency tree
Every license you inherit by installing http-signature, not just its own. Check this before a legal review, not after.
Compatibility
- Node.js
- node >=0.10
- Module format
- CommonJS only
- TypeScript
- No bundled types
- Install scripts
- None
Quick start
A usage example from the http-signature README.
var fs = require('fs');
var https = require('https');
var httpSignature = require('http-signature');
var key = fs.readFileSync('./key.pem', 'ascii');
var options = {
host: 'localhost',
port: 8443,
path: '/',
method: 'GET',
headers: {}
};
http-signature vs the alternatives
Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.
| Package | Weekly downloads | Dependents | License | Last release |
|---|---|---|---|---|
| http-signaturethis page | 0 | 1 | MIT | 2 years ago |
| undici | 0 | 15 | MIT | 2 hours ago |
| pac-proxy-agent | 0 | 1 | MIT | 2 hours ago |
| @mswjs/interceptors | 0 | 1 | MIT | 2 hours ago |
| make-fetch-happen | 43.3M | 1 | ISC | 2 hours ago |
| node-forge | 36M | 5 | (BSD-3-Clause OR GPL-2.0) | 2 hours ago |
Dependencies
Declared by http-signature v1.4.0. Runtime dependencies are installed with the package; dev dependencies are not.
Runtime (3)
Dev (2)
Used by
Popular packages that depend on http-signature.
Relationship graph
Dependencies (left) and dependents (right) of http-signature.
Frequently installed together
A querystring parser that supports nesting and arrays, with a depth limit
A stream that emits multiple other streams one after another.
Signs and prepares requests using AWS Signature Version 4
A library to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications.
Implementation of Function.prototype.bind
Port of jQuery.extend for node.js and the browser
Implements performance.now (based on process.hrtime).
OAuth 1 signing. Formerly a vendor lib in mikeal/request, now a standalone module.
Detect whether or not an object is a Typed Array
Like JSON.stringify, but doesn't blow up on circular refs.
Caseless object set/get/has, very useful when working with HTTP headers.
HTTP Agent that keeps socket connections alive between keep-alive requests. Formerly part of mikeal/request, now a standalone module.
Release history
No releases in the last two years, typically about 86 days apart.
| Version | Published | Size | License |
|---|---|---|---|
| 1.4.0latest | 2 years ago | 38 KB | MIT |
| 1.3.6 | 4 years ago | 40 KB | MIT |
| 1.3.5 | 5 years ago | 40 KB | MIT |
| 1.3.4 | 6 years ago | 37 KB | MIT |
| 1.3.3 | 6 years ago | 36 KB | MIT |
| 1.3.2 | 6 years ago | 34 KB | MIT |
| 1.3.1 | 6 years ago | 34 KB | MIT |
| 1.3.0 | 6 years ago | 48 KB | MIT |
| 1.2.0 | 9 years ago | — | MIT |
| 1.1.1 | 10 years ago | — | MIT |
| 1.1.0 | 10 years ago | — | MIT |
| 1.0.2 | 10 years ago | — | MIT |
| 1.0.1 | 10 years ago | — | MIT |
| 1.0.0 | 10 years ago | — | MIT |
| 0.11.0 | 11 years ago | — | MIT |
Overview
http-signature is an npm package that reference implementation of Joyent's HTTP Signature scheme. It has 1 known dependents in the graph. The latest version is 1.4.0, released under the MIT license.
Who should use it
Teams working in the npm ecosystem who need reference implementation of Joyent's HTTP Signature scheme and value a focused solution.
When not to use it
Consider an alternative if you need to have first-class TypeScript types out of the box, or if a more actively-maintained option better fits your npm stack.
Pros
- Clear open-source license (MIT).
Cons
- No bundled TypeScript types (may require a separate @types package).
Auto-generated from collected registry metadata. No external claims are inferred.
Frequently asked questions
Should I use http-signature?
http-signature is usable, with caveats. Last published 980 days ago.
How do I install http-signature?
Run `npm install http-signature` to add http-signature to your npm project.
How many dependencies does http-signature have?
http-signature declares 5 direct dependencies and pulls in 4 packages in total once its runtime tree is resolved totalling about 335 KB on disk.
What license is http-signature released under?
http-signature is distributed under the MIT license.
How popular is http-signature?
npm does not publish download counts. Within PackageGraph's crawl, 1 known packages depend on http-signature.
Is http-signature still maintained?
The most recent release of http-signature (v1.4.0) was published 2 years ago.
Does http-signature run install scripts?
No. http-signature does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.