iph-secure-payload-client

A small browser-safe secure HTTP client for frontend apps.

It wraps fetch and adds:

• Bearer token support
• CSRF header support
• request body encryption using AES-GCM
• request and response message integrity using HMAC-SHA256
• in-band session HMAC rotation support
• a lightweight fetch-based API with get, post, put, patch, and delete

Install

Use a local package reference or publish this package.

npm install iph-secure-payload-client

If you are using it in this repository as a local library, set the dependency to:

"iph-secure-payload-client": "file:../libraries/secure-api-client"

Usage

import { createSecureApiClient } from "iph-secure-payload-client";

const secureApi = createSecureApiClient({
  baseUrl: "http://localhost:5000",
  getAccessToken: () => localStorage.getItem("accessToken"),
  getHmacSecret: () => sessionStorage.getItem("hmacSecret"),
  setHmacSecret: (secret) => sessionStorage.setItem("hmacSecret", secret || ""),
  onUnauthorized: () =>
    window.dispatchEvent(new CustomEvent("auth:unauthorized")),
});

const data = await secureApi.post("/api/products", { name: "Shirt" });

API

• createSecureApiClient(options) — build a secure client instance
• client.get(url)
• client.post(url, body)
• client.put(url, body)
• client.patch(url, body)
• client.delete(url)

Notes

• The library uses browser fetch and crypto.subtle.
• It is intentionally dependency-free at runtime.
• If a response includes a x-session-hmac header, the client updates the session HMAC secret.