Network APIs

EventSource dispatches a named message as an event of that name, so onmessage never sees it. Register eventSource.addEventListener('priceUpdate', handler) instead, and expect event.data as a string you parse yourself.

Drive it from an abort signal: fetch(url, { signal: AbortSignal.timeout(5000) }) aborts the request when the timer fires. The manual equivalent is an AbortController plus setTimeout calling controller.abort(), with the timer cleared afterwards.

The send() call throws an InvalidStateError, because the socket is still in the CONNECTING state — the constructor only starts the connection. Send once the open event has fired and readyState is WebSocket.OPEN.

An ordinary fetch is tied to the document that started it, so when the document is destroyed the browser aborts the request still in flight. sendBeacon marks the request as keepalive, handing it to the browser to complete after the page is gone.

EventSource reconnects by itself after a dropped connection, firing error each time. Check readyState: CONNECTING means it will retry, CLOSED means it gave up. It gives up on close(), or when the response is not 200 with Content-Type text/event-stream.

Code 1006 means the connection ended without a close handshake, so the browser synthesised the code locally rather than receiving one. The error event is deliberately detail-free for security, so 1006 alone cannot distinguish a rejected connection from a dropped network link.

An XMLHttpRequest moves through readyState 0 UNSENT, 1 OPENED, 2 HEADERS_RECEIVED, 3 LOADING and 4 DONE, firing readystatechange on each step. Modern code prefers the load, error, timeout, abort and loadend events because each names one outcome instead of requiring a state check.

XMLHttpRequest exposes an upload object, and progress events fired on xhr.upload report bytes sent. As of 2026 fetch has no equivalent upload-progress event, which is why file-upload widgets that show a live bar are still written against XHR.

On mobile a tab is usually backgrounded and later discarded or killed, so unload frequently never fires at all. Send at visibilitychange when the state becomes hidden, with pagehide as a backstop, using sendBeacon or a keepalive fetch.

Reconnect with capped exponential backoff plus jitter, skip reconnecting after a deliberate client close or a permanent application close code, and resubscribe and resync state on every new socket. Heartbeats must be ordinary application messages on a timer, since scripts cannot send WebSocket ping frames.

navigator.sendBeacon returns a boolean immediately: true means the browser queued the data for sending, false means it refused to queue it, usually because the payload was too large. True is not a delivery receipt, and no response is ever readable.

Setting XMLHttpRequest's responseType to 'json' makes the browser parse the body for you and expose the parsed value on xhr.response. Reading xhr.responseText then throws an InvalidStateError, because that getter is only legal when responseType is the empty string or 'text'.

fetch with keepalive gives the same survive-the-page guarantee as sendBeacon while letting you choose the method, set headers such as Content-Type, control credentials, and read the response. The cost is a shared in-flight body budget of about 64 KiB per document.

A multipart body is split by a random boundary token the browser generates and normally advertises in the Content-Type header it sets for you. A hand-written multipart/form-data header has no boundary parameter, so the server cannot parse the parts. Omit the header.

A fetch Response body is a one-shot stream, not a stored string. The first read consumes it and sets response.bodyUsed to true, so a second read throws a TypeError. Call response.clone() before reading if two consumers need it.

credentials controls whether the browser attaches cookies, HTTP authentication entries and TLS client certificates to a fetch request, and whether it stores Set-Cookie from the response. It defaults to 'same-origin', so cross-origin calls need credentials: 'include'.

EventSource accepts only a URL and { withCredentials }. It cannot set an Authorization header, cannot change the method from GET, and sends no body. Cross-origin credentialed streams need the server to allow that exact origin and credentials.

response.body is a ReadableStream of byte chunks: call getReader() and loop on read() until done. Piping it through TextDecoderStream turns those bytes into text correctly even when a multi-byte character is split across two chunks.

binaryType chooses how a browser WebSocket hands you binary messages: 'blob' (the default) or 'arraybuffer'. Set it to 'arraybuffer' immediately after constructing the socket when you need to read bytes synchronously instead of doing an asynchronous Blob read.

A Request carries a one-shot body, and sending it consumes that body. The second fetch on the same Request finds bodyUsed already true and throws a TypeError. Clone the Request before each attempt, or rebuild it from the URL and init.

Each route visit opens a stream that nothing closes, and an EventSource stays open and self-reconnects until close() is called. Over HTTP/1.1 the leaked streams occupy the browser's roughly six connections per origin, so every other request queues.

Dropping the reference does not end the transfer: the body stream sits un-consumed and its resources are held until it is cancelled or the object is collected. Call response.body.cancel() to discard the body, or controller.abort() to kill the whole request.

Responses complete out of order, so a slower earlier request can land after a newer one and overwrite it. Cancel the previous request with its own AbortController before starting the next, and additionally drop any response whose query no longer matches the current input.

socket.bufferedAmount is the number of bytes passed to send() that the browser has not yet put on the network. send() never blocks or fails on a slow link, so an unbounded producer simply grows that queue; sampling bufferedAmount and pausing above a threshold is the only backpressure the API offers.

Passing false as the third argument to XMLHttpRequest's open() makes send() block the thread until the whole response arrives. On the main thread that freezes rendering, input and every other task for the duration, which is why browsers log a deprecation warning and restrict the mode.

Set xhr.timeout in milliseconds to bound a request and call xhr.abort() to cancel one. A timeout fires the timeout event, an abort fires the abort event, and neither fires load — which is why teardown belongs in loadend, the event that fires on every outcome.

Match the transport to the traffic shape. A one-way feed suits server-sent events, which ride ordinary HTTP and reconnect themselves; WebSockets earn their extra machinery only with real client-to-server chat; polling wins when updates are rare and latency tolerance is loose.

sendBeacon accepts no headers, so the Content-Type is derived from the body type, and a string always becomes text/plain;charset=UTF-8. Either parse text/plain on the server, send a Blob typed application/json, or use fetch with keepalive and explicit headers.