Skip to content

http

Make HTTP requests from your app.

Sep 20, 2026
  • 1198a524 Security: Added the scopeRedirects plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including localhost services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.

    {
    "plugins": {
    "http": {
    "scopeRedirects": true
    }
    }
    }

    It is opt-in because a redirect to a URL that is not allowed by the scope now fails with url not allowed on the configured scope instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. This will become the default in v3.

    Note that tauri_plugin_http::init() now returns TauriPlugin<R, Option<Config>> instead of TauriPlugin<R>.

Sep 16, 2026
  • a21555dd (#3566 by @followdarko) Fix unhandled promise rejections on every fetch teardown: the request/body cleanup commands were fired as floating promises, and releasing an already-released resource rejects with The resource id N is invalid.. dropBody is now idempotent and both cleanup calls handle their own rejection.
Aug 31, 2026
May 2, 2026
Apr 4, 2026
  • 29712892 (#3252 by @NVolcz) Correct Response header initialization to support cloning and ensure Set-Cookie visibility.
Feb 3, 2026
  • 61e9b0ab (#3228) Cleanup resource when the returned ReadableStream.cancel is called to avoid memory leaks
Jan 14, 2026
  • b1dbee2c (#3210 by @FabianLars) Fixed an issue that caused the Origin header to always be null on macOS, iOS and Linux.
Jan 8, 2026
Oct 27, 2025
  • 93426f85 Fixed an issue that caused docs.rs builds to fail. No user facing changes.
Oct 26, 2025
Aug 20, 2025
Jul 20, 2025
Jun 25, 2025
May 20, 2025
Apr 2, 2025
  • 37c0477a (#2561) Add zstd cargo feature flag to enable reqwest/zstd flag.
  • 9ebbfb2e (#1978) Persist cookies to disk and load it on next app start.
Mar 17, 2025
  • a15eedf3 (#2535 by @amrbashir) Fix fetch occasionally throwing an error due to trying to close the underline stream twice.
Mar 15, 2025
  • d3183aa9 (#2522 by @adrieljss) Fix fetch blocking until the whole response is read even if it was a streaming response.
Mar 10, 2025
Jan 27, 2025
  • 10513649 (#2204 by @RickeyWard) Add dangerous-settings feature flag and new JS danger option to disable tls hostname/certificate validation.
Dec 9, 2024
  • 3a79266b (#2173 by @FabianLars) Bumped all plugins to v2.2.0. From now, the versions for the Rust and JavaScript packages of each plugin will be in sync with each other.

http full changelog


© 2026 Tauri Contributors. CC-BY / MIT