Axios — HTTP Client for PHP APIs
debt(d7/e3/b3/t3)
Closest to 'only careful code review or runtime testing' (d7). The detection_hints list ESLint as the tool but explicitly state automated=no, meaning ESLint won't catch these patterns automatically. Missing 401 interceptors, deprecated CancelToken usage, and mixed axios instances without create() are not caught by default linting rules — they require careful code review or runtime failures (e.g. a 401 loop) to surface.
Closest to 'simple parameterised fix' (e3). The quick_fix is 'Use axios.create() with a base URL and interceptors for centralised CSRF, auth, and error handling' — this is a small refactor within one component (creating a configured axios instance and wiring interceptors), not a single-line swap but not a cross-cutting architectural change either. Replacing CancelToken with AbortController signal is similarly scoped.
Closest to 'localised tax' (b3). The applies_to scope is web only, and the mistakes (missing interceptors, deprecated CancelToken, mixed instances) are localised to the HTTP client layer. Once axios.create() is used correctly, the rest of the codebase is largely unaffected. It doesn't spread architectural weight broadly.
Closest to 'minor surprise' (t3). The misconception is that Axios is more secure than fetch — a subtle but not catastrophic misbelief. The common mistakes (CancelToken deprecation, missing 401 handling) are documented gotchas but not the kind that fundamentally contradict how similar concepts work elsewhere. A competent developer may be mildly surprised but not severely misled.
Also Known As
TL;DR
Explanation
Laravel includes axios pre-configured: axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest' and automatic CSRF token from meta tag. Interceptors enable global error handling, token refresh, and request logging. Axios automatically parses JSON responses (unlike fetch which requires .json()). CancelToken (deprecated; use AbortController now). axios.create() for multiple API clients with different base URLs.
Common Misconception
Why It Matters
Common Mistakes
- Using CancelToken (deprecated) instead of AbortController signal
- Not handling 401 token refresh in interceptors
- Mixing axios instances with different base URLs without create()
Code Examples
// No error handling, no CSRF on non-Laravel setup:
axios.post('/api/save', data)
.then(res => console.log(res.data));// Central axios instance with interceptors:
const api = axios.create({ baseURL: '/api', timeout: 10000 });
// CSRF token injection:
api.defaults.headers.common['X-CSRF-Token'] =
document.querySelector('meta[name=csrf-token]')?.content;
// Response error interceptor:
api.interceptors.response.use(
res => res,
async err => {
if (err.response?.status === 401) await refreshToken();
return Promise.reject(err);
}
);
await api.post('/save', data); // auto JSON + CSRF + error handling