no-native-http

The no-native-http rule prevents usage of browser HTTP APIs (Fetch and XMLHttpRequest) in UI extensions.

Rule details

UI extensions run in a sandboxed web worker environment where browser HTTP APIs (fetch() and XMLHttpRequest) are intentionally replaced with error-throwing functions for security reasons. All HTTP requests must go through either:

hubspot.fetch() for runtime HTTP requests with URL allowlisting.
Serverless functions for backend API calls in privately distributed apps using platform version 2025.1.

This rule detects and prevents usage of browser HTTP APIs that will fail at runtime.

hubspot.fetch() is not a one-to-one replacement for the browser fetch() method. For example, hubspot.fetch() can only call URLs that have been added to permittedUrls in your app’s configuration. Learn more about fetching data in UI extensions.

Examples

Browser fetch()

Instead of using fetch():

// Incorrect
async function getData() {
  const response = await fetch('https://api.example.com/data');
  return response.json();
}

Use hubspot.fetch():

import { hubspot } from '@hubspot/ui-extensions';

async function getData() {
  const response = await hubspot.fetch('https://api.example.com/data');
  return response.json();
}

Destructuring from hubspot is also allowed:

import { hubspot } from '@hubspot/ui-extensions';

const { fetch } = hubspot;

async function getData() {
  const response = await fetch('https://api.example.com/data');
  return response.json();
}

XMLHttpRequest

Instead of using XMLHttpRequest:

// Incorrect
function getData() {
  const xhr = new XMLHttpRequest();
  xhr.open('GET', 'https://api.example.com/data');
  xhr.send();
}

Use hubspot.fetch():

import { hubspot } from '@hubspot/ui-extensions';

async function getData() {
  const response = await hubspot.fetch('https://api.example.com/data');
  return response.json();
}

Build apps

Add features

Publish to the HubSpot Marketplace

Skeleton group 5

Rule details

Examples

Browser fetch()

XMLHttpRequest

​Rule details

​Examples

​Browser fetch()

​XMLHttpRequest

​Related resources

Rule details

Examples

Browser fetch()

XMLHttpRequest

Related resources