Node.js v19.9.0 documentation

Determining if crypto support is unavailable#

It is possible for Node.js to be built without including support for the node:crypto module. In such cases, attempting to import from https or calling require('node:https') will result in an error being thrown.

When using CommonJS, the error thrown can be caught using try/catch:

let https;
try {
  https = require('node:https');
} catch (err) {
  console.error('https support is disabled!');
} copy

When using the lexical ESM import keyword, the error can only be caught if a handler for process.on('uncaughtException') is registered before any attempt to load the module is made (using, for instance, a preload module).

When using ESM, if there is a chance that the code may be run on a build of Node.js where crypto support is not enabled, consider using the import() function instead of the lexical import keyword:

let https;
try {
  https = await import('node:https');
} catch (err) {
  console.error('https support is disabled!');
} copy

Class: https.Agent#

An Agent object for HTTPS similar to http.Agent. See https.request() for more information.

new Agent([options])#

• options <Object> Set of configurable options to set on the agent. Can have the same fields as for http.Agent(options), and

  • maxCachedSessions <number> maximum number of TLS cached sessions. Use 0 to disable TLS session caching. Default: 100.

  • servername <string> the value of Server Name Indication extension to be sent to the server. Use empty string '' to disable sending the extension. Default: host name of the target server, unless the target server is specified using an IP address, in which case the default is '' (no extension).

    See Session Resumption for information about TLS session reuse.

Event: 'keylog'#

• line <Buffer> Line of ASCII text, in NSS SSLKEYLOGFILE format.
• tlsSocket <tls.TLSSocket> The tls.TLSSocket instance on which it was generated.

The keylog event is emitted when key material is generated or received by a connection managed by this agent (typically before handshake has completed, but not necessarily). This keying material can be stored for debugging, as it allows captured TLS traffic to be decrypted. It may be emitted multiple times for each socket.

A typical use case is to append received lines to a common text file, which is later used by software (such as Wireshark) to decrypt the traffic:

// ...
https.globalAgent.on('keylog', (line, tlsSocket) => {
  fs.appendFileSync('/tmp/ssl-keys.log', line, { mode: 0o600 });
}); copy

Class: https.Server#

• Extends: <tls.Server>

See http.Server for more information.

server.close([callback])#

• callback <Function>
• Returns: <https.Server>

See server.close() in the node:http module.

server.closeAllConnections()#

See server.closeAllConnections() in the node:http module.

server.closeIdleConnections()#

See server.closeIdleConnections() in the node:http module.

server.headersTimeout#

• <number> Default: 60000

See server.headersTimeout in the node:http module.

server.listen()#

Starts the HTTPS server listening for encrypted connections. This method is identical to server.listen() from net.Server.

server.maxHeadersCount#

• <number> Default: 2000

See server.maxHeadersCount in the node:http module.

server.requestTimeout#

• <number> Default: 300000

See server.requestTimeout in the node:http module.

server.setTimeout([msecs][, callback])#

• msecs <number> Default: 120000 (2 minutes)
• callback <Function>
• Returns: <https.Server>

See server.setTimeout() in the node:http module.

server.timeout#

• <number> Default: 0 (no timeout)

See server.timeout in the node:http module.

server.keepAliveTimeout#

• <number> Default: 5000 (5 seconds)

See server.keepAliveTimeout in the node:http module.

https.createServer([options][, requestListener])#

• options <Object> Accepts options from tls.createServer(), tls.createSecureContext() and http.createServer().
• requestListener <Function> A listener to be added to the 'request' event.
• Returns: <https.Server>

// curl -k https://localhost:8000/
const https = require('node:https');
const fs = require('node:fs');

const options = {
  key: fs.readFileSync('test/fixtures/keys/agent2-key.pem'),
  cert: fs.readFileSync('test/fixtures/keys/agent2-cert.pem'),
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('hello world\n');
}).listen(8000); copy

Or

const https = require('node:https');
const fs = require('node:fs');

const options = {
  pfx: fs.readFileSync('test/fixtures/test_cert.pfx'),
  passphrase: 'sample',
};

https.createServer(options, (req, res) => {
  res.writeHead(200);
  res.end('hello world\n');
}).listen(8000); copy

https.get(options[, callback])#

https.get(url[, options][, callback])#

• url <string> | <URL>
• options <Object> | <string> | <URL> Accepts the same options as https.request(), with the method always set to GET.
• callback <Function>

Like http.get() but for HTTPS.

options can be an object, a string, or a URL object. If options is a string, it is automatically parsed with new URL(). If it is a URL object, it will be automatically converted to an ordinary options object.

const https = require('node:https');

https.get('https://encrypted.google.com/', (res) => {
  console.log('statusCode:', res.statusCode);
  console.log('headers:', res.headers);

  res.on('data', (d) => {
    process.stdout.write(d);
  });

}).on('error', (e) => {
  console.error(e);
}); copy

https.globalAgent#

Global instance of https.Agent for all HTTPS client requests.

https.request(options[, callback])#

https.request(url[, options][, callback])#

• url <string> | <URL>
• options <Object> | <string> | <URL> Accepts all options from http.request(), with some differences in default values:
  • protocol Default: 'https:'
  • port Default: 443
  • agent Default: https.globalAgent
• callback <Function>
• Returns: <http.ClientRequest>

Makes a request to a secure web server.

The following additional options from tls.connect() are also accepted: ca, cert, ciphers, clientCertEngine, crl, dhparam, ecdhCurve, honorCipherOrder, key, passphrase, pfx, rejectUnauthorized, secureOptions, secureProtocol, servername, sessionIdContext, highWaterMark.

options can be an object, a string, or a URL object. If options is a string, it is automatically parsed with new URL(). If it is a URL object, it will be automatically converted to an ordinary options object.