Skip to content
Tauri
GuidesReferencesBlogReleases

http

GitHub crates.io npm Full changelog

Make HTTP requests from your app.

2.7.x

2.7.0

Sep 20, 2026

  • 1198a524 Security: Added the scopeRedirects plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including localhost services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.

    {
      "plugins": {
        "http": {
          "scopeRedirects": true
        }
      }
    }

    It is opt-in because a redirect to a URL that is not allowed by the scope now fails with url not allowed on the configured scope instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. This will become the default in v3.

    Note that tauri_plugin_http::init() now returns TauriPlugin<R, Option<Config>> instead of TauriPlugin<R>.

2.6.x

2.6.1

Sep 16, 2026
  • a21555dd (#3566 by @followdarko) Fix unhandled promise rejections on every fetch teardown: the request/body cleanup commands were fired as floating promises, and releasing an already-released resource rejects with The resource id N is invalid.. dropBody is now idempotent and both cleanup calls handle their own rejection.

2.6.0

Aug 31, 2026
Dependencies
  • Upgraded to fs-js@2.5.2

2.5.x

2.5.9

May 2, 2026
Dependencies
  • Upgraded to fs-js@2.5.1

2.5.8

Apr 4, 2026
  • 29712892 (#3252 by @NVolcz) Correct Response header initialization to support cloning and ensure Set-Cookie visibility.
Dependencies
  • Upgraded to fs-js@2.5.0

2.5.7

Feb 3, 2026
  • 61e9b0ab (#3228) Cleanup resource when the returned ReadableStream.cancel is called to avoid memory leaks

2.5.6

Jan 14, 2026
  • b1dbee2c (#3210 by @FabianLars) Fixed an issue that caused the Origin header to always be null on macOS, iOS and Linux.

2.5.5

Jan 8, 2026
Dependencies
  • Upgraded to fs-js@2.4.5

2.5.4

Oct 27, 2025
  • 93426f85 Fixed an issue that caused docs.rs builds to fail. No user facing changes.
Dependencies
  • Upgraded to fs-js@2.4.4

2.5.3

Oct 26, 2025
Dependencies
  • Upgraded to fs-js@2.4.3

2.5.2

Aug 20, 2025
Dependencies
  • Upgraded to fs-js@2.4.2

2.5.1

Jul 20, 2025
Dependencies
  • Upgraded to fs-js@2.4.1

2.5.0

Jun 25, 2025
Dependencies
  • Upgraded to fs-js@2.4.0

2.4.x

2.4.4

May 20, 2025
Dependencies
  • Upgraded to fs-js@2.3.0

2.4.3

Apr 2, 2025
  • 37c0477a (#2561) Add zstd cargo feature flag to enable reqwest/zstd flag.
  • 9ebbfb2e (#1978) Persist cookies to disk and load it on next app start.
Dependencies
  • Upgraded to fs-js@2.2.1

2.4.2

Mar 17, 2025
  • a15eedf3 (#2535 by @amrbashir) Fix fetch occasionally throwing an error due to trying to close the underline stream twice.

2.4.1

Mar 15, 2025
  • d3183aa9 (#2522 by @adrieljss) Fix fetch blocking until the whole response is read even if it was a streaming response.

2.4.0

Mar 10, 2025

2.3.x

2.3.0

Jan 27, 2025
  • 10513649 (#2204 by @RickeyWard) Add dangerous-settings feature flag and new JS danger option to disable tls hostname/certificate validation.

2.2.x

2.2.0

Dec 9, 2024
  • 3a79266b (#2173 by @FabianLars) Bumped all plugins to v2.2.0. From now, the versions for the Rust and JavaScript packages of each plugin will be in sync with each other.
Dependencies
  • Upgraded to fs@2.2.0

Full Changelog

http full changelog

Version List

Support on Open CollectiveSponsor on GitHub

© 2026 Tauri Contributors. CC-BY / MIT