{"id":15647,"library":"http-deceiver","title":"HTTP Deceiver","description":"http-deceiver is a low-level Node.js module specifically engineered to provide granular control over HTTP stream parsing, allowing developers to process or manipulate raw HTTP request and response data, including potentially malformed or unconventional payloads. This capability makes it suitable for advanced network debugging, security testing (e.g., fuzzing HTTP parsers), or implementing custom proxy solutions where standard HTTP modules might be too restrictive. The package's current stable version is 1.2.7. Given its last update approximately eight years ago (around 2018), it is effectively an abandoned project with no ongoing maintenance or active development. Its event-driven API operates by accepting raw buffer chunks and emitting 'header', 'data', and 'end' events, providing a programmatic interface to dissect and reassemble HTTP message components. Unlike higher-level HTTP client or server libraries, `http-deceiver` directly interacts with the byte stream, offering a unique approach for deep-level HTTP protocol inspection and modification.","status":"abandoned","version":"1.2.7","language":"javascript","source_language":"en","source_url":"ssh://git@github.com/indutny/http-deceiver","tags":["javascript","http","net","deceive"],"install":[{"cmd":"npm install http-deceiver","lang":"bash","label":"npm"},{"cmd":"yarn add http-deceiver","lang":"bash","label":"yarn"},{"cmd":"pnpm add http-deceiver","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"This package is CommonJS-only and exports its primary class as the module.exports value. ESM import syntax will not work.","wrong":"import Deceiver from 'http-deceiver';","symbol":"Deceiver","correct":"const Deceiver = require('http-deceiver');"}],"quickstart":{"code":"const Deceiver = require('http-deceiver');\nconst net = require('net');\n\nconst rawHttpRequest = Buffer.from(\n  'GET /malformed-path HTTP/1.1\\r\\n' +\n  'Host: example.com\\r\\n' +\n  'X-Custom-Header: potential-injection-attempt\\r\\n' +\n  'Content-Length: 0\\r\\n' +\n  '\\r\\n' // Note: A standard HTTP/1.1 request requires two CRLFs at the end of headers.\n);\n\nconst server = net.createServer((socket) => {\n  console.log('Client connected to server.');\n  const deceiver = new Deceiver();\n\n  deceiver.on('error', (err) => {\n    console.error('Deceiver parsing error:', err.message);\n    socket.end('HTTP/1.1 400 Bad Request\\r\\nContent-Type: text/plain\\r\\n\\r\\nDeceiver encountered a parsing error.\\n');\n  });\n\n  deceiver.on('header', (header) => {\n    console.log('Parsed Header:', header);\n    // Example: Manipulate headers for a proxy or security scan\n    if (header['x-custom-header'] && header['x-custom-header'].includes('injection')) {\n      console.warn('Potential injection attempt detected in X-Custom-Header!');\n    }\n  });\n\n  deceiver.on('data', (data) => {\n    console.log('Parsed Data (body chunk):', data.toString());\n  });\n\n  deceiver.on('end', () => {\n    console.log('Deceiver parsing ended successfully.');\n    socket.write('HTTP/1.1 200 OK\\r\\nContent-Length: 18\\r\\nContent-Type: text/plain\\r\\n\\r\\nDeceiver processed it!\\n');\n    socket.end();\n  });\n\n  socket.on('data', (chunk) => {\n    console.log('Received raw chunk from client:', chunk.toString().trim());\n    deceiver.write(chunk); // Feed client data to the deceiver\n  });\n\n  socket.on('end', () => {\n    console.log('Client disconnected from server.');\n    deceiver.end(); // Signal end of input to the deceiver\n  });\n});\n\nserver.listen(3000, () => {\n  console.log('Server listening on port 3000. Simulating client request...');\n\n  const client = net.connect({ port: 3000 }, () => {\n    console.log('Simulated client connected.');\n    client.write(rawHttpRequest);\n    client.end(); // End client connection after sending the request\n  });\n\n  client.on('data', (data) => {\n    console.log('Simulated client received response:', data.toString().trim());\n    server.close(); // Close server after receiving response\n  });\n\n  client.on('end', () => {\n    console.log('Simulated client disconnected after response.');\n  });\n});\n","lang":"javascript","description":"This quickstart demonstrates how to use `http-deceiver` to parse a raw HTTP request fed through a `net.Socket`. It sets up a simple `net` server to receive client data, passes that data to `Deceiver`, and listens for `header`, `data`, and `error` events, simulating deep packet inspection or custom HTTP handling."},"warnings":[{"fix":"Consider using actively maintained alternatives for HTTP parsing and manipulation, especially for security-sensitive applications. If direct buffer manipulation is required, assess modern stream parsing libraries or implement custom parsers with robust error handling.","message":"The `http-deceiver` package has not been updated in approximately eight years and is considered abandoned. This means it is highly unlikely to receive bug fixes, security patches, or compatibility updates for newer Node.js versions or evolving HTTP standards. Using it in production environments is strongly discouraged due to potential security vulnerabilities and instability.","severity":"breaking","affected_versions":">=1.0.0"},{"fix":"Always use the CommonJS `require` syntax: `const Deceiver = require('http-deceiver');`.","message":"Due to its age and CommonJS-only design, `http-deceiver` does not support ES module (ESM) import syntax. Attempting to use `import Deceiver from 'http-deceiver';` will result in a runtime error.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Thoroughly test inputs and outputs. Implement robust error handling for the `deceiver.on('error', ...)` event to catch and manage parsing issues gracefully. Refer to its original (limited) documentation or source code for expected buffer formats.","message":"The library's low-level nature means it expects raw buffer inputs and emits events based on its parsing. Mismanagement of input buffers (e.g., incorrect chunking or malformed HTTP beyond its intended 'deceiving' scope) can lead to 'error' events or unexpected parsing behavior.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"last_verified":"2026-04-21T00:00:00.000Z","next_check":"2026-07-20T00:00:00.000Z","problems":[{"fix":"Ensure that `Deceiver` is instantiated as a class: `const deceiver = new Deceiver();`.","cause":"Attempting to instantiate `http-deceiver` without the `new` keyword, or calling it as a regular function.","error":"TypeError: Deceiver is not a constructor"},{"fix":"This package is strictly CommonJS. If you are in an ESM project, you might need a wrapper or dynamic import if your environment supports it, but the primary fix is to ensure the consuming code is CommonJS or use `const Deceiver = require('http-deceiver');` if your setup allows CJS imports in ESM.","cause":"Attempting to use `require()` to import an ES module, or more likely, using `import` syntax for this CommonJS-only package in an ESM context.","error":"ERR_REQUIRE_ESM: require() of ES Module ... not supported"},{"fix":"Carefully examine the raw HTTP buffer being provided. While `http-deceiver` is designed for flexibility, it still expects a certain underlying structure. Debug the raw bytes to ensure they align with the intended (even if malformed) HTTP protocol. Implement comprehensive error handling for the 'error' event emitted by the deceiver.","cause":"The raw buffer data fed into the `deceiver.write()` method contained syntactical errors or unexpected structures that the parser could not reconcile, even with its 'deceiving' capabilities.","error":"Deceiver error: Parse Error: ... (or similar error message related to parsing)"}],"ecosystem":"npm"}