# Feature catalog — axios/axios

> Canonical page: https://codevetter.com/unpack/axios/feature-catalog

# Feature catalog — axios/axios

Scanned commit 56a5f1acdc41965f464eb59bec6cc828113ba546 (2026-09-16). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The user-facing surface is the axios instance API: a callable default export, per-method aliases generated onto `Axios.prototype`, interceptor managers, cancellation via both `CancelToken` and `AbortSignal`, and a large `AxiosRequestConfig` surface typed in `index.d.ts`/`index.d.cts`. Beyond the classic v1 surface this branch carries newer options: `httpVersion: 2`, `allowedSocketPaths`, `sensitiveHeaders`, `redact`, `formDataHeaderPolicy`, `parseReviver`, and `query` as a first-class HTTP method. Transport features include transparent gzip/deflate/br/zstd decompression, upload/download progress with rate throttling (`maxRate`), proxy handling with CIDR-aware `NO_PROXY` bypass, and `maxContentLength`/`maxBodyLength` enforcement on buffered *and* streamed bodies in all three adapters. Form-data handling is bidirectional: `toFormData`/`formToJSON` plus `formDataToStream` for Node uploads.
- Method aliases are generated in two loops on `Axios.prototype`: `delete/get/head/options` (no body, but forward `config.data` via an own-property check) and `post/put/patch/query` (with body); each of the latter except `query` also gets a `<method>Form` variant that forces `Content-Type: multipart/form-data`. — [lib/core/Axios.js#L252-L296](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/Axios.js#L252-L296)
- `query` is a supported HTTP method throughout: it appears in the frozen `methodList` alongside `purge`/`link`/`unlink`, gets a default header bucket, and is deliberately excluded from the `Form` shorthand generation because multipart bodies don't fit its safe/idempotent semantics. — [lib/core/methodList.js#L3-L16](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/methodList.js#L3-L16) [lib/core/Axios.js#L288-L294](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/Axios.js#L288-L294) [tests/unit/query.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/query.test.js)
- Interceptors are registered through `InterceptorManager.use(fulfilled, rejected, {synchronous, runWhen})` and support `eject(id)` and `clear()`; ejection writes a `null` tombstone and trims trailing tombstones once no `forEach` iteration is in flight, so repeated register/eject cycles don't grow `handlers`. — [lib/core/InterceptorManager.js#L67-L136](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/InterceptorManager.js#L67-L136) [lib/core/InterceptorManager.js#L148-L168](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/InterceptorManager.js#L148-L168) [PRE_RELEASE_CHANGELOG.md#L24](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/PRE_RELEASE_CHANGELOG.md#L24)
- Cancellation is dual-path: legacy `CancelToken` (with `CancelToken.source()`, `throwIfRequested()`, and a `toAbortSignal()` bridge that exposes `signal.unsubscribe`) and modern `config.signal`; `composeSignals` merges any number of signals plus a timeout into one `AbortController`. — [lib/cancel/CancelToken.js#L105-L132](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/cancel/CancelToken.js#L105-L132) [lib/helpers/composeSignals.js#L1-L66](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/composeSignals.js#L1-L66) [lib/core/dispatchRequest.js#L18-L26](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/dispatchRequest.js#L18-L26)
- Node transparent decompression covers gzip/x-gzip/compress/x-compress, deflate (through `ZlibHeaderTransformStream`), brotli, and zstd, each gated on runtime support and each deleting `content-encoding` after piping so downstream consumers aren't confused; `decompress: false` disables the whole path. — [lib/adapters/http.js#L1180-L1220](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1180-L1220) [lib/helpers/ZlibHeaderTransformStream.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/ZlibHeaderTransformStream.js)
- `Accept-Encoding` advertising is transitional-gated: `zstd` is only appended when `transitional.advertiseZstdAcceptEncoding === true` (default `false`), so servers aren't offered an encoding by default. — [lib/adapters/http.js#L938-L945](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L938-L945) [lib/defaults/transitional.js#L3-L10](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/transitional.js#L3-L10)
- HTTP/2 is opt-in via `httpVersion: 2` with `http2Options`; sessions are pooled per-authority by `Http2Sessions.getSession()` using `util.isDeepStrictEqual` on options, and combining HTTP/2 with an applied proxy rejects with `ERR_NOT_SUPPORT`. — [lib/adapters/http.js#L1026-L1042](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1026-L1042) [lib/helpers/Http2Sessions.js#L11-L50](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/Http2Sessions.js#L11-L50) [tests/unit/helpers/Http2Sessions.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/unit/helpers/Http2Sessions.test.js)
- Progress reporting is available on both directions (`onUploadProgress`/`onDownloadProgress`) and is rate-limited plus decorated with `loaded/total/rate/estimated` by `progressEventReducer`/`progressEventDecorator`; `config.maxRate` (scalar or `[up, down]` tuple) throttles bytes via `AxiosTransformStream`. — [lib/adapters/http.js#L860-L903](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L860-L903) [lib/helpers/progressEventReducer.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/progressEventReducer.js) [lib/helpers/AxiosTransformStream.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/AxiosTransformStream.js)
- `data:` URLs are a supported protocol in both Node and fetch adapters: Node returns a synthetic 200 (or 405 for non-GET) built from `fromDataURI`, and both adapters pre-check the decoded size with `estimateDataURLDecodedBytes` against `maxContentLength` before materializing the payload. — [lib/adapters/http.js#L720-L768](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L720-L768) [lib/adapters/fetch.js#L314-L327](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/fetch.js#L314-L327) [lib/helpers/estimateDataURLDecodedBytes.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/estimateDataURLDecodedBytes.js)
- XSRF support reads a cookie (`xsrfCookieName`, default `XSRF-TOKEN`) and sets `xsrfHeaderName` (default `X-XSRF-TOKEN`) only in a standard browser env; `withXSRFToken` may be a boolean or a `(config) => boolean` function, and only strict `=== true` forces attachment cross-origin. — [lib/helpers/resolveConfig.js#L84-L102](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/resolveConfig.js#L84-L102) [lib/defaults/index.js#L151-L152](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/index.js#L151-L152) [tests/browser/xsrf.browser.test.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/tests/browser/xsrf.browser.test.js)
- `AxiosError.toJSON()` supports opt-in redaction: when `config.redact` is a non-empty array, `redactConfig` walks the config (including arrays and `AxiosHeaders`, short-circuiting cycles) and replaces matching keys case-insensitively with `'[REDACTED ****]'`. — [lib/core/AxiosError.js#L28-L72](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/AxiosError.js#L28-L72) [lib/core/AxiosError.js#L170-L198](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/AxiosError.js#L170-L198)
- `sensitiveHeaders: string[]` lets callers name headers that must be stripped on cross-origin redirects; it is validated to be an array of strings (else `ERR_BAD_OPTION_VALUE`) and installed as `options.beforeRedirects.sensitiveHeaders`, layered on top of follow-redirects' own stripping. — [lib/adapters/http.js#L1073-L1108](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1073-L1108) [lib/adapters/http.js#L223-L247](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L223-L247)
- `formDataHeaderPolicy: 'content-only'` narrows which headers a Node FormData implementation may inject to `content-type`/`content-length`; the default `'legacy'` merges everything `getHeaders()` returns. — [lib/core/setFormDataHeaders.js#L1-L28](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/setFormDataHeaders.js#L1-L28) [lib/helpers/resolveConfig.js#L65-L78](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/resolveConfig.js#L65-L78) [index.d.ts#L485](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.d.ts#L485)
- `config.parseReviver` is threaded into the default `transformResponse` as the second argument to `JSON.parse`, giving callers a hook to rewrite parsed response values. — [lib/defaults/index.js#L128-L138](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/index.js#L128-L138) [index.d.ts#L479](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.d.ts#L479)
- Six `transitional` flags gate behavior changes without a major bump: `silentJSONParsing`, `forcedJSONParsing`, `clarifyTimeoutError`, `legacyInterceptorReqResOrdering`, `advertiseZstdAcceptEncoding`, and `validateStatusUndefinedResolves`; each is asserted boolean via `validator.assertOptions` in `Axios._request`. — [lib/defaults/transitional.js#L3-L10](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/transitional.js#L3-L10) [lib/core/Axios.js#L96-L110](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/core/Axios.js#L96-L110)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)