Network Error Logging

Network Error Logging (W3C draft) is the browser's native channel for surfacing failures the server never sees: TLS handshake collapse before the request body, DNS lookup misses, CDN routing resets, premature TCP teardown mid-response. The user-agent buffers these and POSTs JSON reports to a configured collector, keyed by the report-to group named in the NEL header.

The middleware emits two response headers on every request it sees:

Report-To: { "group": "default", "max_age": 86400, "endpoints": [ { "url": "https://collector.example.com/nel" } ] } NEL: { "report_to": "default", "max_age": 86400, "include_subdomains": false, "success_fraction": 0, "failure_fraction": 1 }

Both header values are JSON dictionaries; the framework refuses any operator-supplied collector URL containing CR/LF/NUL so a typo can't smuggle a header-injection payload into the wire format.

Mount AFTER securityHeaders (so the response writeHead order stays predictable) and BEFORE business middleware. Pair with b.middleware.cspReport so a single collector receives both NEL and CSP reports — operators commonly point both at the same /_telemetry endpoint.

app.use(b.middleware.requestId()); app.use(b.middleware.securityHeaders()); app.use(b.middleware.nel({ reportTo: "default", collectorUrl: "https://collector.example.com/nel", maxAge: 86400, includeSubdomains: false, successFraction: 0, failureFraction: 1, }));

The successFraction defaults to 0 because reporting every successful request is a billing surprise on busy origins; operators tune it up (0.001, 0.01) when sampling success distribution intentionally.

b.middleware.nel(req, res, next) #

{
  {
    reportTo:          string,    // group name (default "default")
    collectorUrl:      string,    // required — collector POST URL
    maxAge:            number,    // policy lifetime in seconds (default 86400)
    includeSubdomains: boolean,   // default false
    successFraction:   number,    // 0..1, default 0
    failureFraction:   number,    // 0..1, default 1
  }
}

Builds middleware that emits the W3C Network Error Logging NEL and companion Report-To headers so user-agents post failure telemetry back to an operator-controlled collector. Mount near the top of the chain (after requestId and securityHeaders) so every response carries the headers — NEL is a long-lived browser policy, not a per-route concern.

The two header bodies are JSON dictionaries built once at construct time. Operator-supplied strings flow through a CR/LF/NUL refusal check so a typo in collectorUrl can't smuggle additional headers onto the wire.

var b = require("@blamejs/core");
var app = b.router.create();
app.use(b.middleware.requestId());
app.use(b.middleware.securityHeaders());
app.use(b.middleware.nel({
  collectorUrl:      "https://collector.example.com/nel",
  maxAge:            86400,
  successFraction:   0,
  failureFraction:   1,
}));

Last updated 2026-08-08T16:39:49.652Z by seeder.