Web requests

​

Domains

{
    "api": 1,
    "entry": "plugin/main.lua",
    "permissions": ["net.http"],
    "domains": ["api.example.com", "scores.example.org"]
}

• At most 16 host names. Each is a plain name with at least one dot: letters, digits, . and -, no scheme, port, path or *. Case does not matter.
• A request goes only to a host that is exactly one of them: "example.com" does not allow api.example.com.
• "domains" without the net.http permission is an error in the manifest. See the manifest.

​

What a request may do

• HTTPS only, on port 443, with TLS 1.2 or 1.3. A certificate that is not valid fails the request.
• A host whose name resolves to a private, local or reserved address (your own network, loopback, link-local, multicast) is refused: a plugin never reaches the player’s own network.
• Redirects are not followed: a 301 or 302 comes back to you as it is, with its status.
• No cookies and no Windows sign-in are sent. The user agent is ReSkate-Plugin/<plugin id>.
• The answer is at most 1 MB and comes within 10 seconds, or the request fails.

​

reskate.http.request(options, callback)

reskate.http.request({url = "https://api.example.com/v1/spots?level=downtown"}, function(status, body, err)
    if err then
        reskate.log("the request failed: " .. err, "warn")
        return
    end
    if status ~= 200 then
        reskate.log("the server said " .. status, "warn")
        return
    end
    local ok, spots = pcall(reskate.json.decode, body)
    if ok then reskate.log(#spots .. " spots") end
end)

reskate.http.request({
    url = "https://scores.example.org/submit",
    method = "POST",
    body = reskate.json.encode({player = reskate.id, score = 125000}),
    content_type = "application/json",
}, function(status, body, err)
    reskate.log("submitted: " .. status)
end)