@chrismichaelps / pudu-lang-httpclient
Named HTTP clients for Pudu: a client factory, delegating handlers, pooled keep-alive connections, handler lifetimes, logging, and resilience
0.1.1Apache-2.01
InstallClose
Use @chrismichaelps/pudu-lang-httpclient
Install this release
From your project, run:
pudu install @chrismichaelps/pudu-lang-httpclient@0.1.1An exact version can install a new release immediately. Without a version, pudu follows the 72-hour minimum release age for new resolutions.
pudu install @chrismichaelps/pudu-lang-httpclientThen import it
import PuduLangHttpClient as PuduLangHttpClientTo contribute
git clone https://github.com/chrismichaelps/pudu-lang-httpclient
ADR-0007-secure-defaults.md
ADR-0007 — Defaults that fail safe
type: adr status: Accepted tags: [adr]
Context
Clients forward credentials, store cookies, follow redirects, and log headers; each can leak what the caller meant for one destination.
Decision
- Credentials (
authorization,cookie,proxy-authorization) are dropped when a redirect changes origin, and an https-to-http redirect is never followed ([[src/PuduLangHttpClient/Domain/Redirect]]). - Cookies are off unless a transport asks for them ([[src/PuduLangHttpClient/Cookies]]).
- Observers never see the values of sensitive headers ([[src/PuduLangHttpClient/Factory/Builder]]).
- Response heads and bodies are bounded (64 KiB and 64 MiB), and refused rather than truncated.
- Header values with line breaks are refused before anything is sent.
Consequences
- A program that needs cookies, larger bodies, or public-only destinations says so.
Rejected
- Cookies on by default: a pooled transport would share them between every caller of its name.
Referenced by
[[CHANGELOG]] · [[decisions/_MOC]] · [[handoffs/2026-10-06-initial-package]]