CodeVetter · Repo Unpack · Feature catalog
axios/axios
The user-facing surface is the axios instance API: a callable default export, per-method aliases generated onto `Axios.prototype`, interceptor managers, cancellation via both `CancelToken` and `AbortSignal`, and a large `AxiosRequestConfig` surface typed in `index.d.ts`/`index.d.cts`. Beyond the classic v1 surface this branch carries newer options: `httpVersion: 2`, `allowedSocketPaths`, `sensitiveHeaders`, `redact`, `formDataHeaderPolicy`, `parseReviver`, and `query` as a first-class HTTP method. Transport features include transparent gzip/deflate/br/zstd decompression, upload/download progress with rate throttling (`maxRate`), proxy handling with CIDR-aware `NO_PROXY` bypass, and `maxContentLength`/`maxBodyLength` enforcement on buffered *and* streamed bodies in all three adapters. Form-data handling is bidirectional: `toFormData`/`formToJSON` plus `formDataToStream` for Node uploads.
- Method aliases are generated in two loops on `Axios.prototype`: `delete/get/head/options` (no body, but forward `config.data` via an own-property check) and `post/put/patch/query` (with body); each of the latter except `query` also gets a `<method>Form` variant that forces `Content-Type: multipart/form-data`.
- `query` is a supported HTTP method throughout: it appears in the frozen `methodList` alongside `purge`/`link`/`unlink`, gets a default header bucket, and is deliberately excluded from the `Form` shorthand generation because multipart bodies don't fit its safe/idempotent semantics.
- Interceptors are registered through `InterceptorManager.use(fulfilled, rejected, {synchronous, runWhen})` and support `eject(id)` and `clear()`; ejection writes a `null` tombstone and trims trailing tombstones once no `forEach` iteration is in flight, so repeated register/eject cycles don't grow `handlers`.
- Cancellation is dual-path: legacy `CancelToken` (with `CancelToken.source()`, `throwIfRequested()`, and a `toAbortSignal()` bridge that exposes `signal.unsubscribe`) and modern `config.signal`; `composeSignals` merges any number of signals plus a timeout into one `AbortController`.
- Node transparent decompression covers gzip/x-gzip/compress/x-compress, deflate (through `ZlibHeaderTransformStream`), brotli, and zstd, each gated on runtime support and each deleting `content-encoding` after piping so downstream consumers aren't confused; `decompress: false` disables the whole path.
- `Accept-Encoding` advertising is transitional-gated: `zstd` is only appended when `transitional.advertiseZstdAcceptEncoding === true` (default `false`), so servers aren't offered an encoding by default.
- HTTP/2 is opt-in via `httpVersion: 2` with `http2Options`; sessions are pooled per-authority by `Http2Sessions.getSession()` using `util.isDeepStrictEqual` on options, and combining HTTP/2 with an applied proxy rejects with `ERR_NOT_SUPPORT`.
- Progress reporting is available on both directions (`onUploadProgress`/`onDownloadProgress`) and is rate-limited plus decorated with `loaded/total/rate/estimated` by `progressEventReducer`/`progressEventDecorator`; `config.maxRate` (scalar or `[up, down]` tuple) throttles bytes via `AxiosTransformStream`.
- `data:` URLs are a supported protocol in both Node and fetch adapters: Node returns a synthetic 200 (or 405 for non-GET) built from `fromDataURI`, and both adapters pre-check the decoded size with `estimateDataURLDecodedBytes` against `maxContentLength` before materializing the payload.
- XSRF support reads a cookie (`xsrfCookieName`, default `XSRF-TOKEN`) and sets `xsrfHeaderName` (default `X-XSRF-TOKEN`) only in a standard browser env; `withXSRFToken` may be a boolean or a `(config) => boolean` function, and only strict `=== true` forces attachment cross-origin.
- `AxiosError.toJSON()` supports opt-in redaction: when `config.redact` is a non-empty array, `redactConfig` walks the config (including arrays and `AxiosHeaders`, short-circuiting cycles) and replaces matching keys case-insensitively with `'[REDACTED ****]'`.
- `sensitiveHeaders: string[]` lets callers name headers that must be stripped on cross-origin redirects; it is validated to be an array of strings (else `ERR_BAD_OPTION_VALUE`) and installed as `options.beforeRedirects.sensitiveHeaders`, layered on top of follow-redirects' own stripping.
- `formDataHeaderPolicy: 'content-only'` narrows which headers a Node FormData implementation may inject to `content-type`/`content-length`; the default `'legacy'` merges everything `getHeaders()` returns.
- `config.parseReviver` is threaded into the default `transformResponse` as the second argument to `JSON.parse`, giving callers a hook to rewrite parsed response values.
- Six `transitional` flags gate behavior changes without a major bump: `silentJSONParsing`, `forcedJSONParsing`, `clarifyTimeoutError`, `legacyInterceptorReqResOrdering`, `advertiseZstdAcceptEncoding`, and `validateStatusUndefinedResolves`; each is asserted boolean via `validator.assertOptions` in `Axios._request`.