digest-fetch

digest-fetch is a small JavaScript library that adds HTTP Digest and Basic authentication on top of the standard fetch API or node-fetch. Rather than requiring a full HTTP client, it wraps a single request/response cycle: it sends the request unauthenticated, inspects a 401 response’s WWW-Authenticate header, and transparently retries with a computed digest Authorization header, following RFC 2069, RFC 2617, and RFC 7616.

It supports MD5, SHA-256, and SHA-512-256 hashing algorithms (and their ‘-sess’ variants), works identically in browsers and Node by resolving the runtime’s native fetch or falling back to a dynamically imported node-fetch, and includes a precomputed-hash mode for avoiding plaintext credential storage. Its narrow scope and zero-configuration defaults make it a common building block for talking to APIs and devices — IP cameras and NVRs, legacy enterprise systems — that require Digest Access Authentication rather than bearer tokens or API keys.

What You Get

• A DigestClient class that wraps fetch/node-fetch with automatic digest challenge-response handling
• Support for MD5, SHA-256, and SHA-512-256 hashing algorithms, including their session (‘-sess’) variants
• An HTTP Basic Authentication mode as a drop-in alternative to digest auth
• Bundled TypeScript type declarations
• A factory option for regenerating request bodies (e.g. file streams) before an authenticated retry

Common Use Cases

• Authenticating requests to IP cameras, NVRs, and other embedded devices that only support Digest Access Authentication
• Talking to legacy enterprise or industrial APIs that predate token-based auth
• Building Node.js CLI tools or backend services that need to call digest-protected endpoints
• Adding Basic Authentication support to a fetch-based client without switching HTTP libraries

Under The Hood

Architecture The entire library is a single DigestClient class in digest-fetch-src.js with no internal layering: .fetch() is the sole public entry point, calling getClient() to resolve the global fetch or a dynamically imported node-fetch, then addAuth/addBasicAuth to attach the appropriate Authorization header, with parseAuth/parseQop/makeNonce as private helpers mutating a this.digest state object (nc, algorithm, realm, qop, opaque, nonce, cnonce) across the challenge-response cycle. There is no dependency injection or abstraction boundary between header computation and request dispatch, so any change to addAuth ripples directly into every consumer — a reasonable tradeoff for a library this narrowly scoped.

Tech Stack Shipped as a native ESM package ("type": "module") with a dual types/default exports map pointing straight at the un-bundled source file. Runtime dependencies are all small pure-JS hash/encoding helpers — md5, js-sha256, js-sha512, base-64 — with no native bindings. TypeScript declarations are generated via a tsc --allowJs --emitDeclarationOnly script rather than authored directly. Tests run on Mocha/Chai/chai-http against a real Express fixture server, with coverage via istanbul and CI wired through a legacy .travis.yml (Travis CI, not GitHub Actions).

Code Quality The test suite exercises RFC 2069, RFC 2617, RFC 7616, and RFC 7616 SHA-512-256 variants plus Basic auth, all against a live Express server rather than mocks — a reasonably thorough integration-style suite for the library’s surface area. Error handling is implicit: failed auth simply yields a 401 response rather than a thrown exception, and there is no compiler-enforced typing since the source is plain JavaScript with declarations bolted on afterward. ESLint is configured but commented out of the CI script, so it isn’t actually enforced on every run. Naming is clear and consistent throughout (addAuth, parseAuth, computeHash).

What Makes It Unique Most general-purpose HTTP clients either lack native Digest Auth support or require pulling in a much heavier client to get it. digest-fetch resolves to the runtime’s own fetch when available and only reaches for a dynamically imported node-fetch as a fallback, letting the same code run unmodified in browsers and Node without a bundled dependency. Its precomputed-hash option is a deliberate security affordance — avoiding plaintext password storage — that is uncommon among comparable libraries, though digest authentication itself is a decades-old, well-established RFC rather than a novel concept.