Gathering detailed insights and metrics for react-native-fetch-api
Gathering detailed insights and metrics for react-native-fetch-api
A fetch API polyfill for React Native with text streaming support.
Installations
npm install react-native-fetch-apiDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Node Version
15.10.0
NPM Version
7.5.3
Releases
5
Languages
1
JavaScript
JavaScript (100%)
Developer
react-native-community
Download Statistics
Total Downloads
12,571,705
Last Day
15,222
Last Week
123,311
Last Month
613,463
Last Year
3,966,831
GitHub Statistics
MIT License
85 Stars
638 Commits
12 Forks
4 Watchers
4 Branches
66 Contributors
Updated on May 02, 2025
Maintainers
1
Package Meta Information
Latest Version
3.0.0
Package Id
react-native-fetch-api@3.0.0
Size
11.35 kB
NPM Version
7.5.3
Node Version
15.10.0
Published on
Aug 02, 2021
Total Downloads
Cumulative downloads
Total Downloads
12,571,705
Last Day
-1.9%
15,222
Compared to previous day
Last Week
30.5%
123,311
Compared to previous week
Last Month
28.8%
613,463
Compared to previous month
Last Year
13.6%
3,966,831
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Dev Dependencies
25
@babel/core@babel/eslint-parser@babel/eslint-plugin@babel/plugin-syntax-class-properties@babel/preset-flow@commitlint/cli@commitlint/config-conventional@react-native-community/eslint-configconventional-github-releaserdelayeslinteslint-config-prettiereslint-plugin-flowtypeexecaflow-binhuskylint-stagedquerystringreact-native-polyfill-globalsreact-native-test-runnerreact-native-url-polyfillstandard-versiontext-encodingweb-streams-polyfillzora
fetch
A fetch API polyfill for React Native with text streaming support
This is a fork of GitHub's fetch polyfill, the fetch implementation React Native currently provides. This project features an alternative fetch implementation directy built on top of React Native's Networking API instead of XMLHttpRequest for performance gains. At the same time, it aims to fill in some gaps of the WHATWG specification for fetch, namely the support for text streaming.
In practice, this implementation is a drop-in replacement to GitHub's polyfill as it closely follows its implementation. Do not use this implementation if your application does not require to stream text.
Motivation
GitHub's fetch polyfill, originally designed with the intention to be used in web browsers without support for the fetch standard, most notably does not support the consumption of a response body as a stream.
However, as React Native does not yet provide direct access to the underlying byte stream for responses, we either have to fallback to XMLHttpRequest or React Native's networking API for iOS and Android. Currently, only strings can be transfered through the bridge, thus binary data has to be base64-encoded (source) and while React Native's XHR provides progress events to receive incremental data, it concatenates the response string as data comes in. Although very inefficient, the response can be sliced up, each chunk encoded into its UTF-8 representation with TextEncoder and finally enqueued to the stream.
Instead of relying on XMLHttpRequest, which degrades performance, we remove it out of the equation and have fetch interact with React Native's Networking API directly instead. To make Response.body work, ReadableStream's controller was integrated with native progress events. It's important to stress that progress events are only fired when the native response type is set to text (https://github.com/facebook/react-native/blob/v0.63.4/Libraries/Network/RCTNetworking.mm#L544-L547), therefore limiting streaming to text-only transfers. If you wish to consume binary data, either blob or base64 response types have to be used. In this case, the downside is that the final response body is read as a whole and enqueued to the stream's controller as a single chunk. There is no way to read a partial response of a binary transfer.
For more context, read the following:
- https://github.com/github/fetch/issues/746
- https://github.com/facebook/react-native/issues/27741
- https://hpbn.co/xmlhttprequest/#streaming-data-with-xhr
Related:
Requirements
React Native v0.62.0+ is the minimum version supported where the Networking API has been made public.
This implementation depends on the following web APIs which are not currently available in React Native:
It should be possible remove the dependency on TextEncoder and TextDecoder, but not on ReadableStream. Either way, beware the bundle size of your application will inevitable increase.
To polyfill the above APIs, use react-native-polyfill-globals.
Install
$ npm install react-native-fetch-api --save
Setup
The APIs provided by GitHub's implementation in React Native have to be replaced by those provided by this implementation. To do so, check and install react-native-polyfill-globals and follow the instructions therein.
Usage
No need to import anything after the setup is done. All APIs will be available globally.
Example:
1fetch('https://jsonplaceholder.typicode.com/todos/1') 2 .then(response => response.json()) 3 .then(json => console.log(json))
Check fetch's official documentation to learn more about the concepts and extended usage.
Enable text streaming
A non-standard option was added to fetch to enable incremental events in React Native's networking layer.
1fetch('https://jsonplaceholder.typicode.com/todos/1', { reactNative: { textStreaming: true } }) 2 .then(response => response.body) 3 .then(stream => ...)
Aborting requests
It's possible to abort an on-going request and React Native already supports AbortController, so there is no need for a polyfill.
1const controller = new AbortController(); 2 3fetch('https://jsonplaceholder.typicode.com/todos/1', { signal: controller.signal }) 4 .then(response => response.json()) 5 .then(json => console.log(json))
Learn more about aborting fetch at https://developers.google.com/web/updates/2017/09/abortable-fetch.
Cookies
There is no concept of Cross-Origin Resource Sharing (CORS) in native apps. React Native only accepts a boolean value for the credentials option. As such, to send cookies you can either use same-origin and include.
The Set-Cookie response header returned from the server is a forbidden header name and therefore can't be programmatically read with response.headers.get(). Instead, the platform's native networking stack automatically manages cookies for you.
If you run into issues with cookie-based authentication, read the following:
- https://reactnative.dev/docs/network#known-issues-with-fetch-and-cookie-based-authentication
- https://build.affinity.co/persisting-sessions-with-react-native-4c46af3bfd83
- https://medium.com/locastic/react-native-cookie-based-authentication-80ee18f4c71b
Alternatively, you may consider using the react-native-cookies.
Request caching directive
The only values supported for the cache option are no-cache and no-store and Both achieve exactly the same result. All other values are ignored. Following GitHub's implementation, a cache-busting mechanism is provided by using the query parameter _ which holds the number of milliseconds elapsed since the Epoch when either no-cache or no-store are specified.
Redirect modes directive
The fetch specification defines these values for the redirect option: follow (the default), error, and manual. React Native does not accept such option but it does transparently follow a redirect response given the Location header for 30x status codes.
Tests
To run the test suite, you must use react-native-test-runner CLI. Run the run-tests.js wrapper script to spin up a local HTTP server to execute the networking tests against.
iOS
$ ./run-tests.js --platform ios --simulator '<simulator>' test/index.js
Where <simulator> can be a combination of a device type and iOS version, e.g. iPhone 11 (14.1), or a device UUID.
Check which simulators are available in your system by running the following command:
$ xcrun xctrace list devices
Android
$ ./run-tests.js --platform android --emulator '<emulator>' test/index.js
Where <emulator> is the name of the Android Virtual Device (AVD), e.g. Pixel_API_28_AOSP.
Check which emulators are available in your system by running the following command:
$ emulator -list-avds
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/node-ci.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:102: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:140: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node-ci.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/react-native-community/fetch/node-ci.yml/master?enable=pin
- Info: 0 out of 14 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 3 out of 3 npmCommand dependencies pinned
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
Found 1/30 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/node-ci.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 2 are checked with a SAST tool
Reason
33 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-ff7x-qrg7-qggm
- Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5
- Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
- Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-g6ww-v8xp-vmwg
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-44c6-4v22-4mhx
- Warn: Project is vulnerable to: GHSA-4x5v-gmq8-25ch
- Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6
- Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-38fc-wpqx-33j7
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
Score
2.8
/10
Last Scanned on 2025-06-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More