require-network-timeout
Require timeout configuration for network requests. This rule is part of eslint-plugin-reliability and provides LLM-optimized error messages.
Require timeout configuration for network requests. This rule is part of eslint-plugin-reliability and provides LLM-optimized error messages with suggestions.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Warning (reliability) |
| Auto-Fix | 💡 Suggests fixes |
| Category | Reliability |
| ESLint MCP | ✅ Optimized for ESLint MCP integration |
| Best For | Applications making HTTP requests |
Rule Details
A network request with no bound on how long it may wait can hang forever and
hold its socket. The rule reports a request the file shows to be unbounded: its
options carry neither a timeout nor an abort signal.
Which calls are requests
| Client | Recognised as | Options read from |
|---|---|---|
fetch | the global (also globalThis.fetch, window.fetch, self.fetch); a local function named fetch is not it | 2nd argument |
| axios | the binding imported or required from 'axios' under any name, or the global axios; a local object named axios is not it | |
axios.get / delete / head / options | dotted or axios['get'] | 2nd argument |
axios.post / put / patch (and *Form) | 3rd argument — the 2nd is the request BODY, so a timeout field there bounds nothing | |
axios(config) / axios.request(config) | 1st argument (axios(url, config): 2nd) | |
axios.create, axios.isCancel, … | not requests | — |
What counts as bounded
The options decide it only when the file can see them: an inline object literal,
or one bound to a const (including through a spread of such a const). A
timeout or signal key — however it is spelled (timeout, 'timeout',
['timeout']) — bounds the request. Options the file cannot see — a parameter,
a spread of one — prove nothing, and are not reported.
Examples
❌ Incorrect
const response = await fetch('/api/data');
const result = await axios.get('/api/users', { headers });
await axios.post(url, { timeout: 30 }); // that is the request body✅ Correct
await fetch(url, { signal: AbortSignal.timeout(5000) });
await axios.get(url, { timeout: 5000 });
await axios.post(url, payload, { timeout: 5000 });
export const load = (url: string, init: RequestInit) => fetch(url, init); // options not visible hereConfiguration
No configuration options available.
{
rules: {
'reliability/require-network-timeout': 'warn'
}
}Related Rules
no-await-in-loop- Optimize async loopsno-unhandled-promise- Handle async errors
Further Reading
- AbortController - MDN documentation
- Axios Timeout - Axios configuration
- ESLint MCP Setup - Enable AI assistant integration
Use this rule
npm install -D oxlint-plugin-reliability{ "jsPlugins": ["oxlint-plugin-reliability"], "rules": { "reliability/require-network-timeout": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-reliability'], rules: { 'reliability/require-network-timeout': 'error', }, },});oxlint-plugin-reliability re-exports eslint-plugin-reliability/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.