@boy-offi9-inc/reqkit 0.7.0 → 0.7.1

package/README.md

@@ -48,14 +48,13 @@ const pages = await limit.map(urls, (url) =>
   )
 );
 ```
-
----
+__
 
 ## Playground
 
 Try everything in your browser — retries obeying `Retry-After`, rate limiting, the circuit breaker, caching, SSE streaming, an SSE stream that reconnects itself, and a resumable download that survives a dropped connection. It runs against a fake in-memory server, so there's nothing to install and no network involved.
 
-Run it locally: `npm run build && python3 -m http.server -d docs` → open `http://localhost:8000`. (ES modules don't load from `file://`, so it needs a server.)
+Run it locally: `npm run build && python3 -m http.server -d docs` → open `http://localhost:8000`. (ES modules don't load from `file://`, so it needs a server.) The repo's `pages.yml` workflow publishes the same folder to GitHub Pages — enable it once under Settings → Pages → Source: "GitHub Actions".
 
 ## Works with what you already use
 
@@ -76,6 +75,18 @@ Recipes for **axios, ky, got, undici/node-fetch**, testing, and LLM streaming li
 
 ---
 
+## Security
+
+reqkit handles data a server controls (headers, streams, redirects), so the defaults are conservative:
+
+- **Credentials stay home.** With a `baseUrl`, the default `auth` token and default `Authorization` / `Proxy-Authorization` / `Cookie` / `X-API-Key` / `X-Auth-Token` headers are only sent to that origin (plus `trustedOrigins`). Pass an absolute URL to another host and those headers are dropped — the classic "absolute URL leaks the token" bug (the one axios had) can't happen. Headers you pass *for a specific call* are deliberate and always sent. (With neither `baseUrl` nor `trustedOrigins` there's nothing to compare against, so set at least one.)
+- **A server can't steer pagination.** `paginateLinks` refuses a `Link: rel="next"` that points at another origin (`code: "PAGINATE_CROSS_ORIGIN"`) — otherwise a hostile API could send your requests, and any credentials you pass in `init`, to a third party. Allow extra origins with `origins: [...]`.
+- **Streams are bounded.** `readLines` / `readNDJSON` / `readSSE` run in linear time and throw `code: "LINE_TOO_LONG"` past `maxLineLength` (default 16 Mi characters) instead of buffering a never-ending line forever; `withProgress` and `downloadResumable` have `maxBytes`.
+- **Hostile headers are cheap.** `parseLinkHeader` is linear-time and ignores headers over 64 KB.
+- **Safe retries.** `createFetch` only retries idempotent methods (or requests with an `Idempotency-Key`), and a cross-origin redirect is left to `fetch`, which strips `Authorization` itself.
+
+What reqkit does **not** do: it doesn't block requests to private/internal addresses (SSRF protection for server-side use needs DNS-level control). If you fetch user-supplied URLs on a server, validate them first.
+
 ## Pick what you need
 
 | You want to… | Use |
@@ -362,6 +373,8 @@ for await (const row of readNDJSON(response)) console.log(row); // newline-delim
 for await (const line of readLines(response)) console.log(line);
 ```
 
+All three take `{ signal, maxLineLength }` — a line (or one SSE event's data) longer than `maxLineLength` characters (default 16 Mi) throws `code: "LINE_TOO_LONG"` rather than buffering forever.
+
 `readSSE` follows the spec: multi-line `data:` is joined with `\n`, comments are ignored, `event` defaults to `"message"`, `id` carries over, `retry` is parsed, and an event cut off by the end of the stream is dropped. `readNDJSON` skips blank lines and names the bad line on a parse error (or pass `skipInvalid: true`). Line splitting handles `\n`, `\r\n`, `\r`, a BOM, and multi-byte characters split across chunks.
 
 ### Pagination: `paginate`, `paginatePages`, `paginateLinks`
@@ -502,6 +515,7 @@ const admin = api.extend({ headers: { "x-role": "admin" } }); // merges over the
 | `retry` | see below | `false` disables; otherwise `{ retries, statusCodes, methods, baseDelayMs, maxDelayMs, factor, jitter, maxRetryTime, shouldRetry, calculateDelay, onRetry }` |
 | `rateLimit` | — | `true` just learns from `X-RateLimit-*` / `Retry-After`; `{ requests, perMs }` also enforces a budget; or pass a shared [`createRateLimiter`](#createratelimiteropts) |
 | `circuitBreaker` | — | `true` / options → one breaker **per origin**; or pass a shared [`createCircuitBreaker`](#createcircuitbreakeropts), or `(url) => breaker`. An open circuit stops retries immediately. |
+| `trustedOrigins` | — | extra origins that may receive the default credentials — see [Security](#security) |
 | `auth` | — | attach a token and refresh it on 401 — see [Auth token refresh](#auth-token-refresh) |
 | `cache` | — | in-memory GET cache — see [Caching](#caching). `true` = 60s TTL. Per request: `cache: false` bypasses, `"reload"` refreshes |
 | `dedupe` | `false` | merge identical concurrent `GET`/`HEAD` calls; every caller gets its own readable clone. Requests with their own `signal` are never merged. |

package/dist/reqkit.mjs

@@ -1,4 +1,4 @@
-/*! @boy-offi9-inc/reqkit v0.7.0 — ESM bundle (generated by scripts/build-esm.js, do not edit) */
+/*! @boy-offi9-inc/reqkit v0.7.1 — ESM bundle (generated by scripts/build-esm.js, do not edit) */
 const __defs = {
 "./HTTPError": function (module, exports, require) {
 class HTTPError extends Error {
@@ -165,7 +165,17 @@ async function discardBody(response) {
   }
 }
 
-module.exports = { parseRetryAfter, parseResetMs, getWaitMsFromHeaders, getRateLimitInfo, discardBody };
+/** The origin ("https://host:port") of an absolute URL, or null if `url` is relative/invalid. */
+function getOrigin(url) {
+  try {
+    const { origin } = new URL(String(url));
+    return origin === "null" ? null : origin;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { parseRetryAfter, parseResetMs, getWaitMsFromHeaders, getRateLimitInfo, discardBody, getOrigin };
 
 },
 "./_sleep": function (module, exports, require) {
@@ -409,11 +419,13 @@ const { createRateLimiter } = require("./createRateLimiter");
 const { createCircuitBreaker } = require("./createCircuitBreaker");
 const { createMemoryCache } = require("./createMemoryCache");
 const { cacheKey, snapshotResponse, entryToResponse } = require("./_cache");
-const { discardBody } = require("./_http");
+const { discardBody, getOrigin } = require("./_http");
 
 const DEFAULT_RETRY_STATUS_CODES = [408, 425, 429, 500, 502, 503, 504];
 // Safe to repeat without side effects. POST/PATCH are deliberately absent.
 const DEFAULT_RETRY_METHODS = ["GET", "HEAD", "OPTIONS", "PUT", "DELETE"];
+// Default headers that carry credentials. They're only sent to trusted origins.
+const SENSITIVE_HEADERS = ["authorization", "proxy-authorization", "cookie", "x-api-key", "x-auth-token"];
 
 function isAbsoluteUrl(url) {
   return /^[a-z][a-z0-9+.-]*:/i.test(url);
@@ -447,11 +459,7 @@ function isStreamBody(body) {
 }
 
 function originOf(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url;
-  }
+  return getOrigin(url) || url;
 }
 
 // One in-flight token refresh per `auth` config object, so concurrent 401s —
@@ -501,6 +509,9 @@ function mergeDefaults(base, extra) {
  *  - concurrent GET de-duplication (withDedupe)
  *  - `auth`: attach a token, and on a 401 refresh it ONCE (shared by all
  *    concurrent requests) and replay the request
+ *  - credential safety: default credentials (`auth`, and default headers like
+ *    Authorization/Cookie/X-API-Key) are only sent to `baseUrl`'s origin and
+ *    `trustedOrigins` — pass an absolute URL to another host and they stay home
  *  - `HTTPError` on non-2xx (turn off with `throwHttpErrors: false`)
  *  - `onRequest` / `onResponse` hooks
  *
@@ -523,6 +534,9 @@ function mergeDefaults(base, extra) {
  *   whatever `shouldRefresh(response)` says) `refresh({ token, response })` is
  *   called once for all concurrent callers and the request is replayed with the
  *   new token. `header` defaults to "authorization", `scheme` to "Bearer" ("" for none).
+ * @param {string[]} [defaults.trustedOrigins] - extra origins ("https://cdn.example.com") that may
+ *   receive the default credentials, besides `baseUrl`'s. With neither `baseUrl` nor
+ *   `trustedOrigins` set there is nothing to compare against and credentials go everywhere.
  * @param {boolean} [defaults.dedupe=false] - merge identical concurrent GET/HEAD calls
  * @param {boolean} [defaults.throwHttpErrors=true]
  * @param {typeof fetch} [defaults.fetch=globalThis.fetch]
@@ -540,6 +554,7 @@ function createFetch(defaults = {}) {
     circuitBreaker,
     cache,
     auth,
+    trustedOrigins,
     dedupe = false,
     throwHttpErrors: defaultThrow = true,
     fetch: customFetch,
@@ -549,6 +564,18 @@ function createFetch(defaults = {}) {
 
   const doFetch = (...args) => (customFetch || globalThis.fetch)(...args);
 
+  // Origins allowed to receive default credentials. Empty = no baseUrl to compare against = unrestricted.
+  const trusted = new Set();
+  for (const o of [baseUrl, ...(trustedOrigins || [])]) {
+    const origin = o && getOrigin(o);
+    if (origin) trusted.add(origin);
+  }
+  const isTrustedTarget = (url) => {
+    if (trusted.size === 0 || !isAbsoluteUrl(url)) return true; // relative URLs resolve against our own base
+    const origin = getOrigin(url);
+    return origin !== null && trusted.has(origin);
+  };
+
   // --- stateful pieces, built once so `extend()` children share them -------
   const limiter = !rateLimit
     ? null
@@ -645,7 +672,18 @@ function createFetch(defaults = {}) {
     } = init;
 
     const method = String(fetchInit.method || "GET").toUpperCase();
-    const headers = mergeHeaders(await resolveHeaders(defaultHeaders), new Headers(initHeaders || undefined));
+    const url = joinUrl(baseUrl, input, query);
+    const credentialsAllowed = isTrustedTarget(url);
+
+    const defaultHeaderSet = await resolveHeaders(defaultHeaders);
+    if (!credentialsAllowed) {
+      // An absolute URL to some other host: don't hand it our default credentials.
+      for (const name of [...SENSITIVE_HEADERS, ...(auth && auth.header ? [String(auth.header).toLowerCase()] : [])]) {
+        defaultHeaderSet.delete(name);
+      }
+    }
+    // Headers the caller passes for *this* call are deliberate, so they always go through.
+    const headers = mergeHeaders(defaultHeaderSet, new Headers(initHeaders || undefined));
 
     let body = fetchInit.body;
     if (json !== undefined) {
@@ -653,7 +691,7 @@ function createFetch(defaults = {}) {
       if (!headers.has("content-type")) headers.set("content-type", "application/json");
     }
 
-    const ctx = { url: joinUrl(baseUrl, input, query), init: { ...fetchInit, method, headers, body } };
+    const ctx = { url, init: { ...fetchInit, method, headers, body } };
     if (onRequest) await onRequest(ctx);
     const finalHeaders = ctx.init.headers instanceof Headers ? ctx.init.headers : new Headers(ctx.init.headers);
     const finalMethod = String(ctx.init.method || method).toUpperCase();
@@ -662,7 +700,7 @@ function createFetch(defaults = {}) {
     const authHeader = auth ? String(auth.header || "authorization").toLowerCase() : null;
     const formatToken = (token) => (auth.scheme === "" ? String(token) : `${auth.scheme === undefined ? "Bearer" : auth.scheme} ${token}`);
     let usedToken = null;
-    if (auth && !finalHeaders.has(authHeader)) {
+    if (auth && credentialsAllowed && !finalHeaders.has(authHeader)) {
       usedToken = (await auth.getToken()) || null;
       if (usedToken) finalHeaders.set(authHeader, formatToken(usedToken));
     }
@@ -837,6 +875,9 @@ function createFetch(defaults = {}) {
     return finish(response);
   }
 
+  /** The `baseUrl` this instance was created with (paginateLinks uses it to stay on-origin). */
+  request.baseUrl = baseUrl;
+
   /** Like `request`, but resolves to the parsed JSON body (null for an empty body). */
   request.json = async (input, init) => {
     const response = await request(input, init);
@@ -1648,6 +1689,9 @@ module.exports = { normalizeError };
 },
 "./paginate": function (module, exports, require) {
 const { HTTPError } = require("./HTTPError");
+const { getOrigin } = require("./_http");
+
+const MAX_LINK_HEADER_LENGTH = 64 * 1024;
 
 /**
  * Parses an RFC 8288 `Link` header (GitHub, GitLab, WordPress... use it for
@@ -1659,7 +1703,8 @@ const { HTTPError } = require("./HTTPError");
  * ```
  *
  * A link with several rels (`rel="next last"`) is listed under each; the first
- * link wins when a rel appears twice. Commas inside `<...>` are handled.
+ * link wins when a rel appears twice. Commas inside `<...>` are handled. Input
+ * is treated as untrusted: headers over 64 KB are ignored and parsing is linear-time.
  *
  * @param {string | null | undefined} header
  * @param {string} [base]
@@ -1667,10 +1712,11 @@ const { HTTPError } = require("./HTTPError");
  */
 function parseLinkHeader(header, base) {
   const links = {};
-  if (!header) return links;
+  // Link headers are server-controlled; real ones are a few hundred bytes (HTTP stacks cap headers at ~16 KB).
+  if (!header || header.length > MAX_LINK_HEADER_LENGTH) return links;
 
   // <url> followed by any number of `; name` / `; name=token` / `; name="quoted, value"` params
-  const linkRe = /<([^>]*)>((?:\s*;\s*[^=;,<\s]+(?:\s*=\s*(?:"[^"]*"|[^;,<\s]*))?)*)/g;
+  const linkRe = /<([^<>]*)>((?:\s*;\s*[^=;,<\s]+(?:\s*=\s*(?:"[^"]*"|[^;,<\s]*))?)*)/g;
   let match;
   while ((match = linkRe.exec(header)) !== null) {
     const rel = /;\s*rel\s*=\s*(?:"([^"]*)"|([^\s;,]+))/i.exec(match[2]);
@@ -1797,15 +1843,39 @@ function defaultGetItems(data) {
  * @param {number} [opts.maxItems=Infinity]
  * @param {AbortSignal} [opts.signal]
  * @param {object} [opts.init] - extra options passed to every `request`
+ * @param {string[]} [opts.origins] - origins a `Link` may point to. Default: the origin of `url`
+ *   (or of the `createFetch` instance's `baseUrl`). A `Link` to anywhere else throws
+ *   `code: "PAGINATE_CROSS_ORIGIN"` — a server could otherwise steer your requests (and any
+ *   credentials in `init`) to a third party. The check is skipped only when no origin can be determined.
  */
 async function* paginateLinks(request, url, opts = {}) {
   const { getItems = defaultGetItems, init = {}, signal } = opts;
 
+  const allowed = new Set();
+  if (opts.origins) {
+    for (const o of opts.origins) {
+      const origin = getOrigin(o);
+      if (origin) allowed.add(origin);
+    }
+  } else {
+    const origin = getOrigin(url) || getOrigin(request && request.baseUrl) || getOrigin(globalThis.location && globalThis.location.href);
+    if (origin) allowed.add(origin);
+  }
+
   async function fetchPage(pageUrl) {
     const res = await request(pageUrl, { ...init, signal });
     if (!res.ok) throw new HTTPError(res, { method: init.method || "GET", url: pageUrl });
     const items = getItems(await res.json(), res);
     const next = parseLinkHeader(res.headers.get("link"), pageUrl).next;
+    if (next && allowed.size > 0) {
+      const nextOrigin = getOrigin(next);
+      if (nextOrigin !== null && !allowed.has(nextOrigin)) {
+        throw Object.assign(
+          new Error(`paginateLinks: refusing to follow a Link to another origin (${nextOrigin}). Pass { origins: [...] } if that's intended.`),
+          { code: "PAGINATE_CROSS_ORIGIN" }
+        );
+      }
+    }
     return { items, next };
   }
 
@@ -2159,46 +2229,83 @@ async function* chunks(source, signal) {
   }
 }
 
+const DEFAULT_MAX_LINE_LENGTH = 16 * 1024 * 1024;
+
+function lineTooLong(limit) {
+  return Object.assign(
+    new Error(`reqkit streams: a line exceeded ${limit} characters without a line break (raise \`maxLineLength\` if that's expected)`),
+    { code: "LINE_TOO_LONG" }
+  );
+}
+
 /**
  * Async-iterates the text lines of a streamed body. Handles \n, \r\n and \r,
  * multi-byte characters split across chunks, and a leading BOM.
  *
+ * Runs in linear time and bounded memory: only newly arrived text is scanned,
+ * and a "line" longer than `maxLineLength` characters (default 16 Mi — a
+ * server that never sends a newline) throws `code: "LINE_TOO_LONG"` instead
+ * of buffering forever.
+ *
  * ```js
  * for await (const line of readLines(response)) console.log(line);
  * ```
  *
  * @param {Response | ReadableStream | AsyncIterable<Uint8Array>} source
- * @param {{ signal?: AbortSignal }} [opts]
+ * @param {{ signal?: AbortSignal, maxLineLength?: number }} [opts]
  * @returns {AsyncGenerator<string>}
  */
 async function* readLines(source, opts = {}) {
+  const { maxLineLength = DEFAULT_MAX_LINE_LENGTH } = opts;
   const decoder = new TextDecoder("utf-8");
-  let buffer = "";
+  const terminator = /[\r\n]/g;
+
+  let parts = []; // pieces of the line being assembled (no terminators in them)
+  let partsLength = 0;
+  let skipLF = false; // the previous line ended with "\r", so a leading "\n" belongs to it
   let first = true;
 
   for await (const chunk of chunks(source, opts.signal)) {
-    buffer += decoder.decode(chunk, { stream: true });
-    if (first && buffer.length > 0) {
-      buffer = buffer.replace(/^\uFEFF/, "");
+    let text = decoder.decode(chunk, { stream: true });
+    if (first && text.length > 0) {
+      text = text.replace(/^\uFEFF/, "");
       first = false;
     }
 
-    let pos = 0;
-    for (;;) {
-      const rest = buffer.slice(pos);
-      const i = rest.search(/\r\n|\n|\r/);
-      if (i === -1) break;
-      // A trailing "\r" might be the first half of "\r\n" — wait for more data.
-      if (rest[i] === "\r" && i === rest.length - 1) break;
-      yield rest.slice(0, i);
-      pos += i + (rest.startsWith("\r\n", i) ? 2 : 1);
+    let start = 0;
+    terminator.lastIndex = 0;
+    let match;
+    while ((match = terminator.exec(text)) !== null) {
+      const ch = match[0];
+      if (ch === "\n" && skipLF && match.index === start) {
+        skipLF = false; // the "\n" of a "\r\n" pair — swallow it
+        start = match.index + 1;
+        continue;
+      }
+      skipLF = false;
+
+      const piece = text.slice(start, match.index);
+      if (partsLength + piece.length > maxLineLength) throw lineTooLong(maxLineLength);
+      const line = parts.length > 0 ? parts.join("") + piece : piece;
+      parts = [];
+      partsLength = 0;
+      yield line;
+
+      start = match.index + 1;
+      skipLF = ch === "\r";
+    }
+
+    if (start < text.length) {
+      const rest = text.slice(start);
+      partsLength += rest.length;
+      if (partsLength > maxLineLength) throw lineTooLong(maxLineLength);
+      parts.push(rest);
+      skipLF = false;
     }
-    buffer = buffer.slice(pos);
   }
 
-  buffer += decoder.decode();
-  if (buffer.endsWith("\r")) buffer = buffer.slice(0, -1);
-  if (buffer.length > 0) yield buffer;
+  const tail = parts.join("") + decoder.decode();
+  if (tail.length > 0) yield tail;
 }
 
 /**
@@ -2238,11 +2345,13 @@ async function* readNDJSON(source, opts = {}) {
  * ```
  *
  * @param {Response | ReadableStream | AsyncIterable<Uint8Array>} source
- * @param {{ signal?: AbortSignal }} [opts]
+ * @param {{ signal?: AbortSignal, maxLineLength?: number }} [opts] - `maxLineLength` also caps the data of a single event
  */
 async function* readSSE(source, opts = {}) {
+  const maxEventLength = opts.maxLineLength ?? DEFAULT_MAX_LINE_LENGTH;
   let event = "";
   let data = [];
+  let dataLength = 0;
   let retry;
   let lastId = "";
 
@@ -2251,6 +2360,7 @@ async function* readSSE(source, opts = {}) {
       if (data.length > 0) yield { event: event || "message", data: data.join("\n"), id: lastId, retry };
       event = "";
       data = [];
+      dataLength = 0;
       retry = undefined;
       continue;
     }
@@ -2262,7 +2372,11 @@ async function* readSSE(source, opts = {}) {
     if (value.startsWith(" ")) value = value.slice(1);
 
     if (field === "event") event = value;
-    else if (field === "data") data.push(value);
+    else if (field === "data") {
+      dataLength += value.length + 1;
+      if (dataLength > maxEventLength) throw lineTooLong(maxEventLength);
+      data.push(value);
+    }
     else if (field === "id") {
       if (!value.includes("\0")) lastId = value;
     } else if (field === "retry") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boy-offi9-inc/reqkit",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Small, composable HTTP helpers — retry with backoff and Retry-After, timeouts, normalized errors, rate limiter, circuit breaker, response cache, resumable downloads, SSE/NDJSON streams, mock fetch, and an opt-in createFetch. Not a client; works alongside fetch/axios/anything.",
   "main": "./src/index.js",
   "types": "./types/index.d.ts",

package/src/_http.js

@@ -87,4 +87,14 @@ async function discardBody(response) {
   }
 }
 
-module.exports = { parseRetryAfter, parseResetMs, getWaitMsFromHeaders, getRateLimitInfo, discardBody };
+/** The origin ("https://host:port") of an absolute URL, or null if `url` is relative/invalid. */
+function getOrigin(url) {
+  try {
+    const { origin } = new URL(String(url));
+    return origin === "null" ? null : origin;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { parseRetryAfter, parseResetMs, getWaitMsFromHeaders, getRateLimitInfo, discardBody, getOrigin };

package/src/createFetch.js

@@ -9,11 +9,13 @@ const { createRateLimiter } = require("./createRateLimiter");
 const { createCircuitBreaker } = require("./createCircuitBreaker");
 const { createMemoryCache } = require("./createMemoryCache");
 const { cacheKey, snapshotResponse, entryToResponse } = require("./_cache");
-const { discardBody } = require("./_http");
+const { discardBody, getOrigin } = require("./_http");
 
 const DEFAULT_RETRY_STATUS_CODES = [408, 425, 429, 500, 502, 503, 504];
 // Safe to repeat without side effects. POST/PATCH are deliberately absent.
 const DEFAULT_RETRY_METHODS = ["GET", "HEAD", "OPTIONS", "PUT", "DELETE"];
+// Default headers that carry credentials. They're only sent to trusted origins.
+const SENSITIVE_HEADERS = ["authorization", "proxy-authorization", "cookie", "x-api-key", "x-auth-token"];
 
 function isAbsoluteUrl(url) {
   return /^[a-z][a-z0-9+.-]*:/i.test(url);
@@ -47,11 +49,7 @@ function isStreamBody(body) {
 }
 
 function originOf(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url;
-  }
+  return getOrigin(url) || url;
 }
 
 // One in-flight token refresh per `auth` config object, so concurrent 401s —
@@ -101,6 +99,9 @@ function mergeDefaults(base, extra) {
  *  - concurrent GET de-duplication (withDedupe)
  *  - `auth`: attach a token, and on a 401 refresh it ONCE (shared by all
  *    concurrent requests) and replay the request
+ *  - credential safety: default credentials (`auth`, and default headers like
+ *    Authorization/Cookie/X-API-Key) are only sent to `baseUrl`'s origin and
+ *    `trustedOrigins` — pass an absolute URL to another host and they stay home
  *  - `HTTPError` on non-2xx (turn off with `throwHttpErrors: false`)
  *  - `onRequest` / `onResponse` hooks
  *
@@ -123,6 +124,9 @@ function mergeDefaults(base, extra) {
  *   whatever `shouldRefresh(response)` says) `refresh({ token, response })` is
  *   called once for all concurrent callers and the request is replayed with the
  *   new token. `header` defaults to "authorization", `scheme` to "Bearer" ("" for none).
+ * @param {string[]} [defaults.trustedOrigins] - extra origins ("https://cdn.example.com") that may
+ *   receive the default credentials, besides `baseUrl`'s. With neither `baseUrl` nor
+ *   `trustedOrigins` set there is nothing to compare against and credentials go everywhere.
  * @param {boolean} [defaults.dedupe=false] - merge identical concurrent GET/HEAD calls
  * @param {boolean} [defaults.throwHttpErrors=true]
  * @param {typeof fetch} [defaults.fetch=globalThis.fetch]
@@ -140,6 +144,7 @@ function createFetch(defaults = {}) {
     circuitBreaker,
     cache,
     auth,
+    trustedOrigins,
     dedupe = false,
     throwHttpErrors: defaultThrow = true,
     fetch: customFetch,
@@ -149,6 +154,18 @@ function createFetch(defaults = {}) {
 
   const doFetch = (...args) => (customFetch || globalThis.fetch)(...args);
 
+  // Origins allowed to receive default credentials. Empty = no baseUrl to compare against = unrestricted.
+  const trusted = new Set();
+  for (const o of [baseUrl, ...(trustedOrigins || [])]) {
+    const origin = o && getOrigin(o);
+    if (origin) trusted.add(origin);
+  }
+  const isTrustedTarget = (url) => {
+    if (trusted.size === 0 || !isAbsoluteUrl(url)) return true; // relative URLs resolve against our own base
+    const origin = getOrigin(url);
+    return origin !== null && trusted.has(origin);
+  };
+
   // --- stateful pieces, built once so `extend()` children share them -------
   const limiter = !rateLimit
     ? null
@@ -245,7 +262,18 @@ function createFetch(defaults = {}) {
     } = init;
 
     const method = String(fetchInit.method || "GET").toUpperCase();
-    const headers = mergeHeaders(await resolveHeaders(defaultHeaders), new Headers(initHeaders || undefined));
+    const url = joinUrl(baseUrl, input, query);
+    const credentialsAllowed = isTrustedTarget(url);
+
+    const defaultHeaderSet = await resolveHeaders(defaultHeaders);
+    if (!credentialsAllowed) {
+      // An absolute URL to some other host: don't hand it our default credentials.
+      for (const name of [...SENSITIVE_HEADERS, ...(auth && auth.header ? [String(auth.header).toLowerCase()] : [])]) {
+        defaultHeaderSet.delete(name);
+      }
+    }
+    // Headers the caller passes for *this* call are deliberate, so they always go through.
+    const headers = mergeHeaders(defaultHeaderSet, new Headers(initHeaders || undefined));
 
     let body = fetchInit.body;
     if (json !== undefined) {
@@ -253,7 +281,7 @@ function createFetch(defaults = {}) {
       if (!headers.has("content-type")) headers.set("content-type", "application/json");
     }
 
-    const ctx = { url: joinUrl(baseUrl, input, query), init: { ...fetchInit, method, headers, body } };
+    const ctx = { url, init: { ...fetchInit, method, headers, body } };
     if (onRequest) await onRequest(ctx);
     const finalHeaders = ctx.init.headers instanceof Headers ? ctx.init.headers : new Headers(ctx.init.headers);
     const finalMethod = String(ctx.init.method || method).toUpperCase();
@@ -262,7 +290,7 @@ function createFetch(defaults = {}) {
     const authHeader = auth ? String(auth.header || "authorization").toLowerCase() : null;
     const formatToken = (token) => (auth.scheme === "" ? String(token) : `${auth.scheme === undefined ? "Bearer" : auth.scheme} ${token}`);
     let usedToken = null;
-    if (auth && !finalHeaders.has(authHeader)) {
+    if (auth && credentialsAllowed && !finalHeaders.has(authHeader)) {
       usedToken = (await auth.getToken()) || null;
       if (usedToken) finalHeaders.set(authHeader, formatToken(usedToken));
     }
@@ -437,6 +465,9 @@ function createFetch(defaults = {}) {
     return finish(response);
   }
 
+  /** The `baseUrl` this instance was created with (paginateLinks uses it to stay on-origin). */
+  request.baseUrl = baseUrl;
+
   /** Like `request`, but resolves to the parsed JSON body (null for an empty body). */
   request.json = async (input, init) => {
     const response = await request(input, init);

package/src/paginate.js

@@ -1,4 +1,7 @@
 const { HTTPError } = require("./HTTPError");
+const { getOrigin } = require("./_http");
+
+const MAX_LINK_HEADER_LENGTH = 64 * 1024;
 
 /**
  * Parses an RFC 8288 `Link` header (GitHub, GitLab, WordPress... use it for
@@ -10,7 +13,8 @@ const { HTTPError } = require("./HTTPError");
  * ```
  *
  * A link with several rels (`rel="next last"`) is listed under each; the first
- * link wins when a rel appears twice. Commas inside `<...>` are handled.
+ * link wins when a rel appears twice. Commas inside `<...>` are handled. Input
+ * is treated as untrusted: headers over 64 KB are ignored and parsing is linear-time.
  *
  * @param {string | null | undefined} header
  * @param {string} [base]
@@ -18,10 +22,11 @@ const { HTTPError } = require("./HTTPError");
  */
 function parseLinkHeader(header, base) {
   const links = {};
-  if (!header) return links;
+  // Link headers are server-controlled; real ones are a few hundred bytes (HTTP stacks cap headers at ~16 KB).
+  if (!header || header.length > MAX_LINK_HEADER_LENGTH) return links;
 
   // <url> followed by any number of `; name` / `; name=token` / `; name="quoted, value"` params
-  const linkRe = /<([^>]*)>((?:\s*;\s*[^=;,<\s]+(?:\s*=\s*(?:"[^"]*"|[^;,<\s]*))?)*)/g;
+  const linkRe = /<([^<>]*)>((?:\s*;\s*[^=;,<\s]+(?:\s*=\s*(?:"[^"]*"|[^;,<\s]*))?)*)/g;
   let match;
   while ((match = linkRe.exec(header)) !== null) {
     const rel = /;\s*rel\s*=\s*(?:"([^"]*)"|([^\s;,]+))/i.exec(match[2]);
@@ -148,15 +153,39 @@ function defaultGetItems(data) {
  * @param {number} [opts.maxItems=Infinity]
  * @param {AbortSignal} [opts.signal]
  * @param {object} [opts.init] - extra options passed to every `request`
+ * @param {string[]} [opts.origins] - origins a `Link` may point to. Default: the origin of `url`
+ *   (or of the `createFetch` instance's `baseUrl`). A `Link` to anywhere else throws
+ *   `code: "PAGINATE_CROSS_ORIGIN"` — a server could otherwise steer your requests (and any
+ *   credentials in `init`) to a third party. The check is skipped only when no origin can be determined.
  */
 async function* paginateLinks(request, url, opts = {}) {
   const { getItems = defaultGetItems, init = {}, signal } = opts;
 
+  const allowed = new Set();
+  if (opts.origins) {
+    for (const o of opts.origins) {
+      const origin = getOrigin(o);
+      if (origin) allowed.add(origin);
+    }
+  } else {
+    const origin = getOrigin(url) || getOrigin(request && request.baseUrl) || getOrigin(globalThis.location && globalThis.location.href);
+    if (origin) allowed.add(origin);
+  }
+
   async function fetchPage(pageUrl) {
     const res = await request(pageUrl, { ...init, signal });
     if (!res.ok) throw new HTTPError(res, { method: init.method || "GET", url: pageUrl });
     const items = getItems(await res.json(), res);
     const next = parseLinkHeader(res.headers.get("link"), pageUrl).next;
+    if (next && allowed.size > 0) {
+      const nextOrigin = getOrigin(next);
+      if (nextOrigin !== null && !allowed.has(nextOrigin)) {
+        throw Object.assign(
+          new Error(`paginateLinks: refusing to follow a Link to another origin (${nextOrigin}). Pass { origins: [...] } if that's intended.`),
+          { code: "PAGINATE_CROSS_ORIGIN" }
+        );
+      }
+    }
     return { items, next };
   }
 

package/src/streams.js

@@ -34,46 +34,83 @@ async function* chunks(source, signal) {
   }
 }
 
+const DEFAULT_MAX_LINE_LENGTH = 16 * 1024 * 1024;
+
+function lineTooLong(limit) {
+  return Object.assign(
+    new Error(`reqkit streams: a line exceeded ${limit} characters without a line break (raise \`maxLineLength\` if that's expected)`),
+    { code: "LINE_TOO_LONG" }
+  );
+}
+
 /**
  * Async-iterates the text lines of a streamed body. Handles \n, \r\n and \r,
  * multi-byte characters split across chunks, and a leading BOM.
  *
+ * Runs in linear time and bounded memory: only newly arrived text is scanned,
+ * and a "line" longer than `maxLineLength` characters (default 16 Mi — a
+ * server that never sends a newline) throws `code: "LINE_TOO_LONG"` instead
+ * of buffering forever.
+ *
  * ```js
  * for await (const line of readLines(response)) console.log(line);
  * ```
  *
  * @param {Response | ReadableStream | AsyncIterable<Uint8Array>} source
- * @param {{ signal?: AbortSignal }} [opts]
+ * @param {{ signal?: AbortSignal, maxLineLength?: number }} [opts]
  * @returns {AsyncGenerator<string>}
  */
 async function* readLines(source, opts = {}) {
+  const { maxLineLength = DEFAULT_MAX_LINE_LENGTH } = opts;
   const decoder = new TextDecoder("utf-8");
-  let buffer = "";
+  const terminator = /[\r\n]/g;
+
+  let parts = []; // pieces of the line being assembled (no terminators in them)
+  let partsLength = 0;
+  let skipLF = false; // the previous line ended with "\r", so a leading "\n" belongs to it
   let first = true;
 
   for await (const chunk of chunks(source, opts.signal)) {
-    buffer += decoder.decode(chunk, { stream: true });
-    if (first && buffer.length > 0) {
-      buffer = buffer.replace(/^\uFEFF/, "");
+    let text = decoder.decode(chunk, { stream: true });
+    if (first && text.length > 0) {
+      text = text.replace(/^\uFEFF/, "");
       first = false;
     }
 
-    let pos = 0;
-    for (;;) {
-      const rest = buffer.slice(pos);
-      const i = rest.search(/\r\n|\n|\r/);
-      if (i === -1) break;
-      // A trailing "\r" might be the first half of "\r\n" — wait for more data.
-      if (rest[i] === "\r" && i === rest.length - 1) break;
-      yield rest.slice(0, i);
-      pos += i + (rest.startsWith("\r\n", i) ? 2 : 1);
+    let start = 0;
+    terminator.lastIndex = 0;
+    let match;
+    while ((match = terminator.exec(text)) !== null) {
+      const ch = match[0];
+      if (ch === "\n" && skipLF && match.index === start) {
+        skipLF = false; // the "\n" of a "\r\n" pair — swallow it
+        start = match.index + 1;
+        continue;
+      }
+      skipLF = false;
+
+      const piece = text.slice(start, match.index);
+      if (partsLength + piece.length > maxLineLength) throw lineTooLong(maxLineLength);
+      const line = parts.length > 0 ? parts.join("") + piece : piece;
+      parts = [];
+      partsLength = 0;
+      yield line;
+
+      start = match.index + 1;
+      skipLF = ch === "\r";
+    }
+
+    if (start < text.length) {
+      const rest = text.slice(start);
+      partsLength += rest.length;
+      if (partsLength > maxLineLength) throw lineTooLong(maxLineLength);
+      parts.push(rest);
+      skipLF = false;
     }
-    buffer = buffer.slice(pos);
   }
 
-  buffer += decoder.decode();
-  if (buffer.endsWith("\r")) buffer = buffer.slice(0, -1);
-  if (buffer.length > 0) yield buffer;
+  const tail = parts.join("") + decoder.decode();
+  if (tail.length > 0) yield tail;
 }
 
 /**
@@ -113,11 +150,13 @@ async function* readNDJSON(source, opts = {}) {
  * ```
  *
  * @param {Response | ReadableStream | AsyncIterable<Uint8Array>} source
- * @param {{ signal?: AbortSignal }} [opts]
+ * @param {{ signal?: AbortSignal, maxLineLength?: number }} [opts] - `maxLineLength` also caps the data of a single event
  */
 async function* readSSE(source, opts = {}) {
+  const maxEventLength = opts.maxLineLength ?? DEFAULT_MAX_LINE_LENGTH;
   let event = "";
   let data = [];
+  let dataLength = 0;
   let retry;
   let lastId = "";
 
@@ -126,6 +165,7 @@ async function* readSSE(source, opts = {}) {
       if (data.length > 0) yield { event: event || "message", data: data.join("\n"), id: lastId, retry };
       event = "";
       data = [];
+      dataLength = 0;
       retry = undefined;
       continue;
     }
@@ -137,7 +177,11 @@ async function* readSSE(source, opts = {}) {
     if (value.startsWith(" ")) value = value.slice(1);
 
     if (field === "event") event = value;
-    else if (field === "data") data.push(value);
+    else if (field === "data") {
+      dataLength += value.length + 1;
+      if (dataLength > maxEventLength) throw lineTooLong(maxEventLength);
+      data.push(value);
+    }
     else if (field === "id") {
       if (!value.includes("\0")) lastId = value;
     } else if (field === "retry") {

package/types/index.d.ts

@@ -210,6 +210,13 @@ export interface CreateFetchDefaults {
   rateLimit?: boolean | RateLimiterOptions | RateLimiter;
   /** Options for a per-origin breaker, a shared breaker instance, or `(url) => breaker`. */
   circuitBreaker?: boolean | CircuitBreakerOptions | CircuitBreaker | ((url: string) => CircuitBreaker);
+  /**
+   * Extra origins ("https://cdn.example.com") that may receive the default credentials
+   * (`auth` and default Authorization/Cookie/X-API-Key headers), besides `baseUrl`'s.
+   * Absolute URLs to any other origin don't get them. With neither `baseUrl` nor
+   * `trustedOrigins` there's nothing to compare against and credentials go everywhere.
+   */
+  trustedOrigins?: string[];
   /** Attach a token and, on a 401, refresh it once (shared by all concurrent requests) and replay. */
   auth?: AuthOptions;
   /** In-memory GET cache with TTL, stale-while-revalidate and ETag/Last-Modified revalidation. `true` = 60s TTL. */
@@ -237,6 +244,8 @@ export interface ReqkitRequestInit extends Omit<RequestInit, "headers" | "cache"
 
 export interface ReqkitFetch {
   (input: string, init?: ReqkitRequestInit): Promise<Response>;
+  /** The `baseUrl` this instance was created with. */
+  readonly baseUrl: string | undefined;
   /** Resolves to the parsed JSON body (null for an empty body). */
   json<T = unknown>(input: string, init?: ReqkitRequestInit): Promise<T>;
   /** New instance with these defaults merged over the current ones. */
@@ -392,6 +401,12 @@ export type StreamSource = Response | ReadableStream<Uint8Array> | AsyncIterable
 
 export interface StreamOptions {
   signal?: AbortSignal;
+  /**
+   * Longest line (or, for readSSE, one event's data) in characters before throwing
+   * `code: "LINE_TOO_LONG"` — protects against a server that never sends a newline.
+   * Default 16 Mi (16 * 1024 * 1024); pass Infinity to disable.
+   */
+  maxLineLength?: number;
 }
 
 export interface SSEEvent {
@@ -505,6 +520,11 @@ export interface PaginateLinksOptions<T = any> {
   signal?: AbortSignal;
   /** Extra options passed to every request. */
   init?: Record<string, any>;
+  /**
+   * Origins a `Link` may point to. Default: the origin of `url` (or of the createFetch
+   * instance's `baseUrl`). Any other origin throws `code: "PAGINATE_CROSS_ORIGIN"`.
+   */
+  origins?: string[];
 }
 
 /** Follows `Link: <...>; rel="next"` headers and yields the items of every page. */