axios
Promise-based HTTP client for the browser and Node.js. Axios handles requests, responses, automatic JSON parsing, request/response interceptors, request cancellation, and timeout configuration. Provides a consistent API across browser (XMLHttpRequest) and Node.js (http module) environments. Long the dominant HTTP client library before the Fetch API became widely adopted.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
HTTPS enforced by browser's fetch implementation or Node.js https module. SSRF is possible if URL is user-controlled — validate URLs before passing to axios. Headers with auth tokens should be cleared for cross-origin requests.
⚡ Reliability
Best When
You need isomorphic HTTP with interceptors, automatic JSON parsing, and upload progress tracking in projects supporting both browser and Node.js.
Avoid When
You're building for modern browsers only or edge runtimes — native fetch is sufficient and requires no dependency.
Use Cases
- • Make HTTP requests from both browser and Node.js with a consistent API without platform-specific handling
- • Add request/response interceptors for auth token injection, error handling, or request logging across all requests
- • Handle file uploads with FormData and track upload/download progress via onUploadProgress callback
- • Configure baseURL and timeout defaults for API clients with automatic retry via axios-retry
- • Use CancelToken or AbortController to cancel in-flight requests for component unmount or user cancellation
Not For
- • New browser-only projects — native fetch() with AbortController is built-in and sufficient for most use cases
- • Edge runtimes (Cloudflare Workers) — axios uses Node.js http internals not compatible with edge; use native fetch
- • High-performance server-side HTTP — for complex server-side HTTP use undici or node-fetch in Node.js 18+
Interface
Authentication
HTTP client library with no auth requirement. Auth tokens are passed via headers in request config or interceptors.
Pricing
Free and open source.
Agent Metadata
Known Gotchas
- ⚠ Axios throws for non-2xx responses by default — unlike fetch which only rejects on network errors; always wrap in try/catch or use validateStatus to change this behavior
- ⚠ Request data serialization depends on Content-Type header — JSON objects are serialized automatically with application/json; FormData requires multipart/form-data header explicitly
- ⚠ Axios interceptors run in the registered order — request interceptors run in reverse order of registration (LIFO); response interceptors run in registration order (FIFO)
- ⚠ axios.create() creates a new instance that doesn't inherit from the default instance — don't mix interceptors registered on axios (default) with instances from create()
- ⚠ CancelToken is deprecated in favor of AbortController — new code should use signal: controller.signal in config; CancelToken may be removed in future versions
- ⚠ Axios 1.x changed how it handles transformRequest for FormData — multipart forms that worked in 0.x may need explicit Content-Type removal (let axios set it automatically) in 1.x
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for axios.
Scores are editorial opinions as of 2026-03-06.