ecki/Node.js-14-Cookbook
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chapters: delete old chapter samples

Browse Source
This commit is contained in:
Beth Griggs
2020-06-28 00:32:12 +01:00
parent 0d8170c265
commit a0906ea9ae
498 changed files with 0 additions and 11344 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Chapter08/anticipating-malicious-input/app/index-fixed.js
-21
View File
@@ -1,21 +0,0 @@
'use strict'
const express = require('express')
const app = express()
app.get('/', (req, res) => {
pretendDbQuery(() => {
var msg = req.query.msg
if (Array.isArray(msg)) msg = msg.pop()
const yelling = (msg || '').toUpperCase()
res.send(yelling)
})
})
app.listen(3000)
function pretendDbQuery (cb) {
setTimeout(cb, 0)
}
Chapter08/anticipating-malicious-input/app/index.js
-17
View File
@@ -1,17 +0,0 @@
'use strict'
const express = require('express')
const app = express()
app.get('/', (req, res) => {
pretendDbQuery(() => {
const yelling = (req.query.msg || '').toUpperCase()
res.send(yelling)
})
})
app.listen(3000)
function pretendDbQuery (cb) {
setTimeout(cb, 0)
}
Chapter08/anticipating-malicious-input/app/package.json
-15
View File
@@ -1,15 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"express": "^4.15.2"
}
}
Chapter08/anticipating-malicious-input/buffer-safety/index-fixed.js
-87
View File
@@ -1,87 +0,0 @@
'use strict'
const http = require('http')
const server = http.createServer((req, res) => {
if (req.method === 'GET') {
res.setHeader('Content-Type', 'text/html')
if (req.url === '/') return res.end(html())
res.setHeader('Content-Type', 'application/json')
if (req.url === '/friends') return res.end(friends())
return
}
if (req.method === 'POST') {
if (req.url === '/') return action(req, res)
}
})
function html (res) {
return `
<div id=friends></div>
<form>
<input id=friend> <input type=submit value="Add Friend">
</form>
<script>
void function () {
var friend = document.getElementById('friend')
var friends = document.getElementById('friends')
function load () {
fetch('/friends', {
headers: {
'Accept': 'application/json, text/plain, */*',
'Content-Type': 'application/json'
}
}).catch((err) => console.error(err))
.then((res) => res.json())
.then((arr) => friends.innerHTML = arr.map((f) => atob(f)).join('<br>'))
}
load()
document.forms[0].addEventListener('submit', function () {
fetch('/', {
method: 'post',
headers: {
'Accept': 'application/json, text/plain, */*',
'Content-Type': 'application/json'
},
body: JSON.stringify({cmd: 'add', friend: friend.value})
}).catch((err) => console.error(err))
.then(load)
})
}()
</script>
`
}
function friends () {
return JSON.stringify(friends.list)
}
friends.list = [Buffer.from('Dave').toString('base64')]
friends.add = (friend) => {
friends.list.push(Buffer.from(friend).toString('base64'))
}
function action (req, res) {
var data = ''
req.on('data', (chunk) => data += chunk)
req.on('end', () => {
try {
data = JSON.parse(data)
} catch (e) {
console.error(e)
res.end('{"ok": false}')
return
}
if (data.cmd === 'add') {
try {
friends.add(data.friend)
} catch (e) {
console.error(e)
res.end('{"ok": false}')
}
}
})
}
server.listen(3000)
Chapter08/anticipating-malicious-input/buffer-safety/index.js
-80
View File
@@ -1,80 +0,0 @@
'use strict'
const http = require('http')
const server = http.createServer((req, res) => {
if (req.method === 'GET') {
res.setHeader('Content-Type', 'text/html')
if (req.url === '/') return res.end(html())
res.setHeader('Content-Type', 'application/json')
if (req.url === '/friends') return res.end(friends())
return
}
if (req.method === 'POST') {
if (req.url === '/') return action(req, res)
}
})
function html (res) {
return `
<div id=friends></div>
<form>
<input id=friend> <input type=submit value="Add Friend">
</form>
<script>
void function () {
var friend = document.getElementById('friend')
var friends = document.getElementById('friends')
function load () {
fetch('/friends', {
headers: {
'Accept': 'application/json, text/plain, */*',
'Content-Type': 'application/json'
}
}).catch((err) => console.error(err))
.then((res) => res.json())
.then((arr) => friends.innerHTML = arr.map((f) => atob(f)).join('<br>'))
}
load()
document.forms[0].addEventListener('submit', function () {
fetch('/', {
method: 'post',
headers: {
'Accept': 'application/json, text/plain, */*',
'Content-Type': 'application/json'
},
body: JSON.stringify({cmd: 'add', friend: friend.value})
}).catch((err) => console.error(err))
.then(load)
})
}()
</script>
`
}
function friends () {
return JSON.stringify(friends.list)
}
friends.list = [Buffer('Dave').toString('base64')]
friends.add = (friend) => friends.list.push(Buffer(friend).toString('base64'))
function action (req, res) {
var data = ''
req.on('data', (chunk) => data += chunk)
req.on('end', () => {
try {
data = JSON.parse(data)
} catch (e) {
res.end('{"ok": false}')
return
}
if (data.cmd === 'add') {
friends.add(data.friend)
}
res.end('{"ok": true}')
})
}
server.listen(3000)
Chapter08/anticipating-malicious-input/json-validation/index-fixed.js
-78
View File
@@ -1,78 +0,0 @@
'use strict'
const http = require('http')
const Ajv = require('ajv')
const ajv = new Ajv
const schema = {
title: 'UserReg',
properties: {
id: {type: 'integer'},
name: {type: 'string'},
privileges: {
anyOf: [
{type: 'string'},
{type: 'boolean'},
{type: 'array', items: {type: 'string'}},
{type: 'object'}
]
}
},
additionalProperties: false,
required: ['id', 'name']
}
const validate = ajv.compile(schema)
const {STATUS_CODES} = http
const server = http.createServer((req, res) => {
if (req.method !== 'POST') {
res.statusCode = 404
res.end(STATUS_CODES[res.statusCode])
return
}
if (req.url === '/register') {
register(req, res)
return
}
res.statusCode = 404
res.end(STATUS_CODES[res.statusCode])
})
function register (req, res) {
var data = ''
req.on('data', (chunk) => data += chunk)
req.on('end', () => {
try {
data = JSON.parse(data)
} catch (e) {
res.end('{"ok": false}')
return
}
const valid = validate(data, schema)
if (!valid) {
console.error(validate.errors)
res.end('{"ok": false}')
return
}
if (data.hasOwnProperty('privileges')) {
createAdminUser(data)
res.end('{"ok": true, "admin": true}')
} else {
createUser(data)
res.end('{"ok": true, "admin": false}')
}
})
}
function createAdminUser (user) {
const key = user.id + user.name
// ...
}
function createUser (user) {
// ...
}
server.listen(3000)
Chapter08/anticipating-malicious-input/json-validation/index.js
-53
View File
@@ -1,53 +0,0 @@
'use strict'
const http = require('http')
const {STATUS_CODES} = http
const server = http.createServer((req, res) => {
if (req.method !== 'POST') {
res.statusCode = 404
res.end(STATUS_CODES[res.statusCode])
return
}
if (req.url === '/register') {
register(req, res)
return
}
res.statusCode = 404
res.end(STATUS_CODES[res.statusCode])
})
function register (req, res) {
var data = ''
req.on('data', (chunk) => data += chunk)
req.on('end', () => {
try {
data = JSON.parse(data)
} catch (e) {
res.end('{"ok": false}')
return
}
// privileges can be multiple types, boolean, array, object, string,
// but the presence of the key means the user is an admin
if (data.hasOwnProperty('privileges')) {
createAdminUser(data)
res.end('{"ok": true, "admin": true}')
} else {
createUser(data)
res.end('{"ok": true, "admin": false}')
}
})
}
function createAdminUser (user) {
const key = user.id + user.name
// ...
}
function createUser (user) {
// ...
}
server.listen(3000)
Chapter08/anticipating-malicious-input/json-validation/package.json
-15
View File
@@ -1,15 +0,0 @@
{
"name": "json-validation",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"ajv": "^4.11.5"
}
}
Chapter08/detecting-dependency-vulnerabilities/app/.snyk
-4
View File
@@ -1,4 +0,0 @@
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.7.0
ignore: {}
patch: {}
Chapter08/detecting-dependency-vulnerabilities/app/package.json
-19
View File
@@ -1,19 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"audit": "auditjs"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"express": "^4.15.2"
},
"devDependencies": {
"auditjs": "^2.0.2"
}
}
Chapter08/guarding-against-xss/app/index.js
-32
View File
@@ -1,32 +0,0 @@
'use strict'
const express = require('express')
const app = express()
app.get('/', (req, res) => {
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery((err, status) => {
if (err) {
res.sendStatus(500)
return
}
res.send(`
<h1>Current Status</h1>
<div id=stat>
${status}
</div>
<div>
<a href="${prev}${handoverToken}/${lang}"> Back to Control HQ </a>
</div>
`)
})
})
function pretendDbQuery (cb) {
const status = 'ON FIRE!!! HELP!!!'
cb(null, status)
}
app.listen(3000)
Chapter08/guarding-against-xss/app/package.json
-15
View File
@@ -1,15 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"express": "^4.15.2"
}
}
Chapter08/guarding-against-xss/fixed-app/index.js
-34
View File
@@ -1,34 +0,0 @@
'use strict'
const express = require('express')
const he = require('he')
const app = express()
app.get('/', (req, res) => {
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery((err, status) => {
if (err) {
res.sendStatus(500)
return
}
const href = he.encode(`${prev}${handoverToken}/${lang}`)
res.send(`
<h1>Current Status</h1>
<div id=stat>
${he.escape(status)}
</div>
<br>
<a href="${href}"> Back to Control HQ </a>
`)
})
})
function pretendDbQuery (cb) {
const status = 'ON FIRE!!! HELP!!!'
cb(null, status)
}
app.listen(3000)
Chapter08/guarding-against-xss/fixed-app/package.json
-16
View File
@@ -1,16 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"express": "^4.15.2",
"he": "^1.1.1"
}
}
Chapter08/guarding-against-xss/fully-escaped-app/index.js
-33
View File
@@ -1,33 +0,0 @@
'use strict'
const express = require('express')
const escapeHtml = require('escape-html')
const app = express()
app.get('/', (req, res) => {
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery((err, status) => {
if (err) {
res.sendStatus(500)
return
}
const href = escapeHtml(`/${prev}${handoverToken}/${lang}`)
res.send(`
<h1>Current Status</h1>
<div id=stat>
${escapeHtml(status)}
</div>
<br>
<a href="${href}"> Back to Control HQ </a>
`)
})
})
function pretendDbQuery (cb) {
const status = 'ON FIRE!!! HELP!!!'
cb(null, status)
}
app.listen(3000)
Chapter08/guarding-against-xss/fully-escaped-app/package.json
-17
View File
@@ -1,17 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"escape-html": "^1.0.3",
"express": "^4.15.2",
"he": "^1.1.1"
}
}
Chapter08/guarding-against-xss/param-constraints-app/index.js
-46
View File
@@ -1,46 +0,0 @@
'use strict'
const express = require('express')
const app = express()
function validate ({prev, handoverToken, lang}, query) {
var valid = Object.keys(query).length <= 3
valid = valid && typeof lang === 'string' && lang.length === 2
valid = valid && typeof handoverToken === 'string' && handoverToken.length === 16
valid = valid && typeof prev === 'string' && prev.length < 10
return valid
}
app.get('/', (req, res) => {
const {prev = '', handoverToken = '', lang = 'en'} = req.query
if (!validate({prev, handoverToken, lang}, req.query)) {
res.sendStatus(422)
return
}
pretendDbQuery((err, status) => {
if (err) {
res.sendStatus(500)
return
}
res.send(`
<h1>Current Status</h1>
<div id=stat>
${status}
</div>
<div>
<a href="${prev}${handoverToken}/${lang}"> Back to Control HQ </a>
</div>
`)
})
})
function pretendDbQuery (cb) {
const status = 'ON FIRE!!! HELP!!!'
cb(null, status)
}
app.listen(3000)
Chapter08/guarding-against-xss/param-constraints-app/package.json
-16
View File
@@ -1,16 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"escape-html": "^1.0.3",
"express": "^4.15.2"
}
}
Chapter08/guarding-against-xss/protocol-safe-app/index.js
-33
View File
@@ -1,33 +0,0 @@
'use strict'
const express = require('express')
const escapeHtml = require('escape-html')
const app = express()
app.get('/', (req, res) => {
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery((err, status) => {
if (err) {
res.sendStatus(500)
return
}
const href = escapeHtml(`/${prev}${handoverToken}/${lang}`)
res.send(`
<h1>Current Status</h1>
<div id=stat>
${escapeHtml(status)}
</div>
<br>
<a href="${href}"> Back to Control HQ </a>
`)
})
})
function pretendDbQuery (cb) {
const status = 'ON FIRE!!! HELP!!!'
cb(null, status)
}
app.listen(3000)
Chapter08/guarding-against-xss/protocol-safe-app/package.json
-16
View File
@@ -1,16 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"escape-html": "^1.0.3",
"express": "^4.15.2"
}
}
Chapter08/preventing-cross-site-request-forgery/app/index.js
-80
View File
@@ -1,80 +0,0 @@
'use strict'
const express = require('express')
const bodyParser = require('body-parser')
const session = require('express-session')
const he = require('he')
const app = express()
const pretendData = {
dave: {
ac: '12345678',
sc: '88-26-26'
}
}
app.use(session({
secret: 'AI overlords are coming',
name: 'SESSIONID',
resave: false,
saveUninitialized: false
}))
app.use(bodyParser.urlencoded({extended: false}))
app.get('/', (req, res) => {
if (req.session.user) return res.redirect('/profile')
res.send(`
<h1> Login </h1>
<form method="POST" action="/">
<label> user <input name=user> </label> <br>
<label> pass <input name=pass type=password> </label> <br>
<input type=submit>
</form>
`)
})
app.post('/', (req, res) => {
if (req.body.user === 'dave' && req.body.pass === 'ncb') {
req.session.user = req.body.user
}
if (req.session.user) res.redirect('/profile')
else res.redirect('/')
})
app.get('/profile', (req, res) => {
if (!req.session.user) return res.redirect('/')
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery(req.session.user, (err, {sc, ac}) => {
if (err) {
res.sendStatus(500)
return
}
sc = he.encode(sc)
ac = he.encode(ac)
res.send(`
<h1>Employee Payment Profile</h1>
<form method="POST" action=/update>
<label> Sort Code <input name=sc value="${sc}"> </label> <br>
<label> Account # <input name=ac value="${ac}"> </label> <br>
<input type=submit>
</form>
`)
})
})
app.post('/update', (req, res) => {
if (!req.session.user) return res.sendStatus(403)
pretendData[req.session.user].ac = req.body.ac
pretendData[req.session.user].sc = req.body.sc
res.send(`
<h1> updated </h1>
<meta http-equiv="refresh" content="1; url=/profile">
`)
})
function pretendDbQuery (user, cb) {
cb(null, pretendData[user])
}
app.listen(3000)
Chapter08/preventing-cross-site-request-forgery/app/package.json
-18
View File
@@ -1,18 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"body-parser": "^1.17.1",
"express": "^4.15.2",
"express-session": "^1.15.2",
"he": "^1.1.1"
}
}
Chapter08/preventing-cross-site-request-forgery/attacker/index.js
-19
View File
@@ -1,19 +0,0 @@
const http = require('http')
const attackerAc = '87654321'
const attackerSc = '11-11-11'
const attackerMsg = 'Everything you could ever want is only one click away'
const server = http.createServer((req, res) => {
res.writeHead(200, {'Content-Type': 'text/html'})
res.end(`
<iframe name=hide style="position:absolute;left:-1000px"></iframe>
<form method="post" action="http://app.local/update" target=hide>
<input type=hidden name=sc value="${attackerAc}">
<input type=hidden name=ac value="${attackerSc}">
<input type=submit value="${attackerMsg}">
</form>
`)
})
server.listen(3001)
Chapter08/preventing-cross-site-request-forgery/fixed-app/index.js
-83
View File
@@ -1,83 +0,0 @@
'use strict'
const express = require('express')
const bodyParser = require('body-parser')
const session = require('express-session')
const he = require('he')
const app = express()
const pretendData = {
dave: {
ac: '12345678',
sc: '88-26-26'
}
}
app.use(session({
secret: 'AI overlords are coming',
name: 'SESSIONID',
resave: false,
saveUninitialized: false,
cookie: {
sameSite: true
}
}))
app.use(bodyParser.urlencoded({extended: false}))
app.get('/', (req, res) => {
if (req.session.user) return res.redirect('/profile')
res.send(`
<h1> Login </h1>
<form method="POST" action="/">
<label> user <input name=user> </label> <br>
<label> pass <input name=pass type=password> </label> <br>
<input type=submit>
</form>
`)
})
app.post('/', (req, res) => {
if (req.body.user === 'dave' && req.body.pass === 'ncb') {
req.session.user = req.body.user
}
if (req.session.user) res.redirect('/profile')
else res.redirect('/')
})
app.get('/profile', (req, res) => {
if (!req.session.user) return res.redirect('/')
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery(req.session.user, (err, {sc, ac}) => {
if (err) {
res.sendStatus(500)
return
}
sc = he.encode(sc)
ac = he.encode(ac)
res.send(`
<h1>Employee Payment Profile</h1>
<form method="POST" action=/update>
<label> Sort Code <input name=sc value="${sc}"> </label> <br>
<label> Account # <input name=ac value="${ac}"> </label> <br>
<input type=submit>
</form>
`)
})
})
app.post('/update', (req, res) => {
if (!req.session.user) return res.sendStatus(403)
pretendData[req.session.user].ac = req.body.ac
pretendData[req.session.user].sc = req.body.sc
res.send(`
<h1> updated </h1>
<meta http-equiv="refresh" content="1; url=/profile">
`)
})
function pretendDbQuery (user, cb) {
cb(null, pretendData[user])
}
app.listen(3000)
Chapter08/preventing-cross-site-request-forgery/fixed-app/package.json
-18
View File
@@ -1,18 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"body-parser": "^1.17.1",
"express": "^4.15.2",
"express-session": "^1.15.2",
"he": "^1.1.1"
}
}
Chapter08/preventing-cross-site-request-forgery/secured-app/index.js
-86
View File
@@ -1,86 +0,0 @@
'use strict'
const express = require('express')
const bodyParser = require('body-parser')
const session = require('express-session')
const he = require('he')
const csurf = require('csurf')
const app = express()
const csrf = csurf()
const pretendData = {
dave: {
ac: '12345678',
sc: '88-26-26'
}
}
app.use(session({
secret: 'AI overlords are coming',
name: 'SESSIONID',
resave: false,
saveUninitialized: false,
cookie: {
sameSite: true
}
}))
app.use(bodyParser.urlencoded({extended: false}))
app.get('/', (req, res) => {
if (req.session.user) return res.redirect('/profile')
res.send(`
<h1> Login </h1>
<form method="POST" action="/">
<label> user <input name=user> </label> <br>
<label> pass <input name=pass type=password> </label> <br>
<input type=submit>
</form>
`)
})
app.post('/', (req, res) => {
if (req.body.user === 'dave' && req.body.pass === 'ncb') {
req.session.user = req.body.user
}
if (req.session.user) res.redirect('/profile')
else res.redirect('/')
})
app.get('/profile', csrf, (req, res) => {
if (!req.session.user) return res.redirect('/')
const {prev = '', handoverToken = '', lang = 'en'} = req.query
pretendDbQuery(req.session.user, (err, {sc, ac}) => {
if (err) {
res.sendStatus(500)
return
}
sc = he.encode(sc)
ac = he.encode(ac)
res.send(`
<h1>Employee Payment Profile</h1>
<form method="POST" action=/update>
<input type=hidden name=_csrf value="${req.csrfToken()}">
<label> Sort Code <input name=sc value="${sc}"> </label> <br>
<label> Account # <input name=ac value="${ac}"> </label> <br>
<input type=submit>
</form>
`)
})
})
app.post('/update', csrf, (req, res) => {
if (!req.session.user) return res.sendStatus(403)
pretendData[req.session.user].ac = req.body.ac
pretendData[req.session.user].sc = req.body.sc
res.send(`
<h1> updated </h1>
<meta http-equiv="refresh" content="1; url=/profile">
`)
})
function pretendDbQuery (user, cb) {
cb(null, pretendData[user])
}
app.listen(3000)
Chapter08/preventing-cross-site-request-forgery/secured-app/package.json
-19
View File
@@ -1,19 +0,0 @@
{
"name": "app",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"body-parser": "^1.17.1",
"csurf": "^1.9.0",
"express": "^4.15.2",
"express-session": "^1.15.2",
"he": "^1.1.1"
}
}
Chapter08/web-server-hardening/app/app.js
-47
View File
@@ -1,47 +0,0 @@
var express = require('express')
var path = require('path')
var favicon = require('serve-favicon')
var logger = require('morgan')
var cookieParser = require('cookie-parser')
var bodyParser = require('body-parser')
var helmet = require('helmet')
var index = require('./routes/index')
var users = require('./routes/users')
var app = express()
// view engine setup
app.set('views', path.join(__dirname, 'views'))
app.set('view engine', 'jade')
// uncomment after placing your favicon in /public
// app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
app.use(helmet())
app.use(logger('dev'))
app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: false }))
app.use(cookieParser())
app.use(express.static(path.join(__dirname, 'public')))
app.use('/', index)
app.use('/users', users)
// catch 404 and forward to error handler
app.use(function (req, res, next) {
var err = new Error('Not Found')
err.status = 404
next(err)
})
// error handler
app.use(function (err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message
res.locals.error = req.app.get('env') === 'development' ? err : {}
// render the error page
res.status(err.status || 500)
res.render('error')
})
module.exports = app
Chapter08/web-server-hardening/app/bin/www
-90
View File
@@ -1,90 +0,0 @@
#!/usr/bin/env node
/**
* Module dependencies.
*/
var app = require('../app');
var debug = require('debug')('app:server');
var http = require('http');
/**
* Get port from environment and store in Express.
*/
var port = normalizePort(process.env.PORT || '3000');
app.set('port', port);
/**
* Create HTTP server.
*/
var server = http.createServer(app);
/**
* Listen on provided port, on all network interfaces.
*/
server.listen(port);
server.on('error', onError);
server.on('listening', onListening);
/**
* Normalize a port into a number, string, or false.
*/
function normalizePort(val) {
var port = parseInt(val, 10);
if (isNaN(port)) {
// named pipe
return val;
}
if (port >= 0) {
// port number
return port;
}
return false;
}
/**
* Event listener for HTTP server "error" event.
*/
function onError(error) {
if (error.syscall !== 'listen') {
throw error;
}
var bind = typeof port === 'string'
? 'Pipe ' + port
: 'Port ' + port;
// handle specific listen errors with friendly messages
switch (error.code) {
case 'EACCES':
console.error(bind + ' requires elevated privileges');
process.exit(1);
break;
case 'EADDRINUSE':
console.error(bind + ' is already in use');
process.exit(1);
break;
default:
throw error;
}
}
/**
* Event listener for HTTP server "listening" event.
*/
function onListening() {
var addr = server.address();
var bind = typeof addr === 'string'
? 'pipe ' + addr
: 'port ' + addr.port;
debug('Listening on ' + bind);
}
Chapter08/web-server-hardening/app/package.json
-18
View File
@@ -1,18 +0,0 @@
{
"name": "app",
"version": "0.0.0",
"private": true,
"scripts": {
"start": "node ./bin/www"
},
"dependencies": {
"body-parser": "~1.16.0",
"cookie-parser": "~1.4.3",
"debug": "~2.6.0",
"express": "~4.14.1",
"helmet": "^3.5.0",
"jade": "~1.11.0",
"morgan": "~1.7.0",
"serve-favicon": "~2.3.2"
}
}
Chapter08/web-server-hardening/app/public/stylesheets/style.css
-8
View File
@@ -1,8 +0,0 @@
body {
padding: 50px;
font: 14px "Lucida Grande", Helvetica, Arial, sans-serif;
}
a {
color: #00B7FF;
}
Chapter08/web-server-hardening/app/routes/index.js
-9
View File
@@ -1,9 +0,0 @@
var express = require('express')
var router = express.Router()
/* GET home page. */
router.get('/', function (req, res, next) {
res.render('index', { title: 'Express' })
})
module.exports = router
Chapter08/web-server-hardening/app/routes/users.js
-9
View File
@@ -1,9 +0,0 @@
var express = require('express')
var router = express.Router()
/* GET users listing. */
router.get('/', function (req, res, next) {
res.send('respond with a resource')
})
module.exports = router
Chapter08/web-server-hardening/app/views/error.jade
-6
View File
@@ -1,6 +0,0 @@
extends layout
block content
h1= message
h2= error.status
pre #{error.stack}
Chapter08/web-server-hardening/app/views/index.jade
-5
View File
@@ -1,5 +0,0 @@
extends layout
block content
h1= title
p Welcome to #{title}
Chapter08/web-server-hardening/app/views/layout.jade
-7
View File
@@ -1,7 +0,0 @@
doctype html
html
head
title= title
link(rel='stylesheet', href='/stylesheets/style.css')
body
block content
Chapter08/web-server-hardening/hapi-app/.gitignore
-1
View File
@@ -1 +0,0 @@
node_modules/
Chapter08/web-server-hardening/hapi-app/LICENSE
-21
View File
@@ -1,21 +0,0 @@
MIT License
Copyright (c) 2017 Azaritech
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Chapter08/web-server-hardening/hapi-app/README.md
-21
View File
@@ -1,21 +0,0 @@
# hapi-starter-kit
Starter kit for Hapi
## Install
```bash
git clone git@github.com:azaritech/hapi-starter-kit.git
cd hapi-starter-kit/
yarn install
# or
npm install
```
## Start
```bash
npm run start
```
### Open browser and go to
[http://localhost:3000/](http://localhost:3000/)
[http://localhost:3000/hello](http://localhost:3000/hello)
Chapter08/web-server-hardening/hapi-app/config/default.json
-12
View File
@@ -1,12 +0,0 @@
{
"connections":
[
{
"server": {
"port": 3000,
"host": "0.0.0.0",
"labels": ["server"]
}
}
]
}
Chapter08/web-server-hardening/hapi-app/lib/index.js
-34
View File
@@ -1,34 +0,0 @@
'use strict';
const util = require('util');
const hapi = require('hapi');
const config = require('getconfig');
const init = require('./init');
const server = new hapi.Server();
// init connections before registering plugins
init.connections(server, config);
server.ext('onPreResponse', (request, reply) => {
var response = request.response.isBoom ?
request.response.output :
request.response;
response.headers['X-DNS-Prefetch-Control'] = 'off';
response.headers['X-DNS-Prefetch-Control'] = 'off';
response.headers['X-Frame-Options'] = 'SAMEORIGIN';
response.headers['X-Download-Options'] = 'noopen';
response.headers['X-Content-Type-Options'] = 'nosniff';
response.headers['X-XSS-Protection'] = '1; mode=block';
reply.continue();
});
// register plugins
init.registers(server);
// loading views
init.views(server);
server.start((err) => {
if (err) {
throw err;
}
server.log('info', 'Server running');
});
Chapter08/web-server-hardening/hapi-app/lib/init.js
-39
View File
@@ -1,39 +0,0 @@
'use strict';
module.exports.connections = function(server, config) {
require('./server').connection(server, config);
};
module.exports.registers = function(server) {
server.register([{
register: require('./logs').register,
options: require('./logs').options
}, {
register: require('nes')
}, {
register: require('vision')
}, {
register: require('inert')
}, {
register: require('./server').register,
select: ['server']
}], (err) => {
if (err) {
throw err;
}
});
};
module.exports.views = function(server) {
server.views({
engines: {
html: require('handlebars')
},
path: __dirname + '/views',
layout: false
//layoutPath: 'views/layout',
//layout: 'default',
//helpersPath: 'views/helpers',
//partialsPath: 'views/partials'
});
}
Chapter08/web-server-hardening/hapi-app/lib/logs.js
-21
View File
@@ -1,21 +0,0 @@
'use strict';
// logging to console
const logs = {
register: require('good'),
options: {
ops: {
interval: 60 * 1000
},
reporters: {
console: [{
module: 'good-console',
args: [ { log: '*', response: '*', request: '*' } ]
},
'stdout'
]
}
}
};
module.exports = logs;
Chapter08/web-server-hardening/hapi-app/lib/server/index.js
-19
View File
@@ -1,19 +0,0 @@
'use strict';
module.exports.connection = function(server, config) {
server.connection({
host: config.connections[0].server.host,
port: config.connections[0].server.port,
labels: config.connections[0].server.labels
});
};
// register plugin
module.exports.register = function (server, options, next) {
require('./routes')(server);
next();
};
module.exports.register.attributes = {
pkg: require('./package.json')
};
Chapter08/web-server-hardening/hapi-app/lib/server/package.json
-4
View File
@@ -1,4 +0,0 @@
{
"name": "server",
"version": "1.0.0"
}
Chapter08/web-server-hardening/hapi-app/lib/server/routes.js
-22
View File
@@ -1,22 +0,0 @@
'use strict';
module.exports = function(server) {
server.route({
method: 'GET',
path: '/',
handler: function (request, reply) {
reply.view('index');
}
});
server.route({
method: 'GET',
path: '/hello',
handler: function (request, reply) {
const data = {
message1: 'Hello',
message2: 'Paris, France'
};
reply.view('hello', data);
}
});
};
Chapter08/web-server-hardening/hapi-app/lib/views/hello.html
-1
View File
@@ -1 +0,0 @@
{{message1}} from {{message2}}.
Chapter08/web-server-hardening/hapi-app/lib/views/index.html
-1
View File
@@ -1 +0,0 @@
Hapi Starter Kit
Chapter08/web-server-hardening/hapi-app/package.json
-24
View File
@@ -1,24 +0,0 @@
{
"name": "hapi-starter-kit",
"version": "1.0.2",
"description": "Starter kit for Hapi",
"main": "lib/index.js",
"repository": "git@github.com:azaritech/hapi-starter-kit.git",
"author": "Nicolas Azari",
"license": "MIT",
"scripts": {
"start": "node lib/index.js",
"test": "echo \"Error: no test specified\" && exit 1"
},
"dependencies": {
"getconfig": "^3.0.0",
"good": "^7.1.0",
"good-console": "^6.4.0",
"handlebars": "^4.0.6",
"hapi": "^16.1.0",
"inert": "^4.1.0",
"nes": "^6.4.0",
"vision": "^4.1.1"
},
"devDependencies": {}
}
Chapter08/web-server-hardening/hapi-app/yarn.lock
-551
View File
@@ -1,551 +0,0 @@
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
# yarn lockfile v1
accept@2.x.x:
version "2.1.3"
resolved "https://registry.yarnpkg.com/accept/-/accept-2.1.3.tgz#ab0f5bda4c449bbe926aea607b3522562f5acf86"
dependencies:
boom "4.x.x"
hoek "4.x.x"
align-text@^0.1.1, align-text@^0.1.3:
version "0.1.4"
resolved "https://registry.yarnpkg.com/align-text/-/align-text-0.1.4.tgz#0cd90a561093f35d0a99256c22b7069433fad117"
dependencies:
kind-of "^3.0.2"
longest "^1.0.1"
repeat-string "^1.5.2"
amdefine@>=0.0.4:
version "1.0.1"
resolved "https://registry.yarnpkg.com/amdefine/-/amdefine-1.0.1.tgz#4a5282ac164729e93619bcfd3ad151f817ce91f5"
ammo@2.x.x:
version "2.0.3"
resolved "https://registry.yarnpkg.com/ammo/-/ammo-2.0.3.tgz#914bbcf65b043ed0f58a8a9d0196e250ec51e6a7"
dependencies:
boom "4.x.x"
hoek "4.x.x"
async@^1.4.0:
version "1.5.2"
resolved "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"
async@~0.2.6:
version "0.2.10"
resolved "https://registry.yarnpkg.com/async/-/async-0.2.10.tgz#b6bbe0b0674b9d719708ca38de8c237cb526c3d1"
b64@3.x.x:
version "3.0.2"
resolved "https://registry.yarnpkg.com/b64/-/b64-3.0.2.tgz#7a9d60466adf7b8de114cbdf651a5fdfcc90894d"
boom@4.x.x:
version "4.2.0"
resolved "https://registry.yarnpkg.com/boom/-/boom-4.2.0.tgz#c1a74174b11fbba223f6162d4fd8851a1b82a536"
dependencies:
hoek "4.x.x"
buffer-shims@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/buffer-shims/-/buffer-shims-1.0.0.tgz#9978ce317388c649ad8793028c3477ef044a8b51"
call@3.x.x:
version "3.0.4"
resolved "https://registry.yarnpkg.com/call/-/call-3.0.4.tgz#e380f2f2a491330aa79085355f8be080877d559e"
dependencies:
boom "4.x.x"
hoek "4.x.x"
call@4.x.x:
version "4.0.0"
resolved "https://registry.yarnpkg.com/call/-/call-4.0.0.tgz#cd29381a98046a132db26e2628e70bd8321a1ddf"
dependencies:
boom "4.x.x"
hoek "4.x.x"
camelcase@^1.0.2:
version "1.2.1"
resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-1.2.1.tgz#9bb5304d2e0b56698b2c758b08a3eaa9daa58a39"
catbox-memory@2.x.x:
version "2.0.4"
resolved "https://registry.yarnpkg.com/catbox-memory/-/catbox-memory-2.0.4.tgz#433e255902caf54233d1286429c8f4df14e822d5"
dependencies:
hoek "4.x.x"
catbox@7.x.x:
version "7.1.3"
resolved "https://registry.yarnpkg.com/catbox/-/catbox-7.1.3.tgz#9817edec5a921743282addfc9c45ace52847eebb"
dependencies:
boom "4.x.x"
hoek "4.x.x"
joi "10.x.x"
center-align@^0.1.1:
version "0.1.3"
resolved "https://registry.yarnpkg.com/center-align/-/center-align-0.1.3.tgz#aa0d32629b6ee972200411cbd4461c907bc2b7ad"
dependencies:
align-text "^0.1.3"
lazy-cache "^1.0.3"
cliui@^2.1.0:
version "2.1.0"
resolved "https://registry.yarnpkg.com/cliui/-/cliui-2.1.0.tgz#4b475760ff80264c762c3a1719032e91c7fea0d1"
dependencies:
center-align "^0.1.1"
right-align "^0.1.1"
wordwrap "0.0.2"
content@3.x.x:
version "3.0.3"
resolved "https://registry.yarnpkg.com/content/-/content-3.0.3.tgz#000f8a01371b95c66afe99be9390fa6cb91aa87a"
dependencies:
boom "4.x.x"
core-util-is@~1.0.0:
version "1.0.2"
resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz#b5fd54220aa2bc5ab57aab7140c940754503c1a7"
cryptiles@3.x.x:
version "3.1.1"
resolved "https://registry.yarnpkg.com/cryptiles/-/cryptiles-3.1.1.tgz#86a9203f7367a0e9324bc7555ff0fcf5f81979ee"
dependencies:
boom "4.x.x"
decamelize@^1.0.0:
version "1.2.0"
resolved "https://registry.yarnpkg.com/decamelize/-/decamelize-1.2.0.tgz#f6534d15148269b20352e7bee26f501f9a191290"
duplexify@^3.1.2:
version "3.5.0"
resolved "https://registry.yarnpkg.com/duplexify/-/duplexify-3.5.0.tgz#1aa773002e1578457e9d9d4a50b0ccaaebcbd604"
dependencies:
end-of-stream "1.0.0"
inherits "^2.0.1"
readable-stream "^2.0.0"
stream-shift "^1.0.0"
end-of-stream@1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.0.0.tgz#d4596e702734a93e40e9af864319eabd99ff2f0e"
dependencies:
once "~1.3.0"
end-of-stream@^1.1.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.1.0.tgz#e9353258baa9108965efc41cb0ef8ade2f3cfb07"
dependencies:
once "~1.3.0"
getconfig@^3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/getconfig/-/getconfig-3.0.0.tgz#e74ca2581d5ec805f8778e1236569453a0f0ae1d"
good-console@^6.4.0:
version "6.4.0"
resolved "https://registry.yarnpkg.com/good-console/-/good-console-6.4.0.tgz#7294c9d90c4c9f059a082e180625495966d2ba59"
dependencies:
hoek "4.x.x"
joi "8.1.x"
json-stringify-safe "5.0.x"
moment "2.15.x"
good@^7.1.0:
version "7.1.0"
resolved "https://registry.yarnpkg.com/good/-/good-7.1.0.tgz#9e05ad24c58a11b71cf5081700f3778db0b22c1c"
dependencies:
hoek "4.x.x"
joi "10.x.x"
oppsy "1.x.x"
pumpify "1.3.x"
handlebars@^4.0.6:
version "4.0.6"
resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.0.6.tgz#2ce4484850537f9c97a8026d5399b935c4ed4ed7"
dependencies:
async "^1.4.0"
optimist "^0.6.1"
source-map "^0.4.4"
optionalDependencies:
uglify-js "^2.6"
hapi@^16.1.0:
version "16.1.0"
resolved "https://registry.yarnpkg.com/hapi/-/hapi-16.1.0.tgz#419dd86347588821eb5a0a5f493bce019802d33b"
dependencies:
accept "2.x.x"
ammo "2.x.x"
boom "4.x.x"
call "4.x.x"
catbox "7.x.x"
catbox-memory "2.x.x"
cryptiles "3.x.x"
heavy "4.x.x"
hoek "4.x.x"
iron "4.x.x"
items "2.x.x"
joi "10.x.x"
mimos "3.x.x"
podium "^1.2.x"
shot "3.x.x"
statehood "5.x.x"
subtext "^4.3.x"
topo "2.x.x"
heavy@4.x.x:
version "4.0.3"
resolved "https://registry.yarnpkg.com/heavy/-/heavy-4.0.3.tgz#976bba118b011b15fe904aa4f292a168bfc6232f"
dependencies:
boom "4.x.x"
hoek "4.x.x"
joi "10.x.x"
hoek@4.x.x:
version "4.1.0"
resolved "https://registry.yarnpkg.com/hoek/-/hoek-4.1.0.tgz#4a4557460f69842ed463aa00628cc26d2683afa7"
inert@^4.1.0:
version "4.1.0"
resolved "https://registry.yarnpkg.com/inert/-/inert-4.1.0.tgz#e68df9fb0b87d8ad688e3428daaf35d623b64f5d"
dependencies:
ammo "2.x.x"
boom "4.x.x"
hoek "4.x.x"
items "2.x.x"
joi "10.x.x"
lru-cache "4.0.x"
inherits@^2.0.1, inherits@~2.0.1:
version "2.0.3"
resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.3.tgz#633c2c83e3da42a502f52466022480f4208261de"
iron@4.x.x:
version "4.0.4"
resolved "https://registry.yarnpkg.com/iron/-/iron-4.0.4.tgz#c1f8cc4c91454194ab8920d9247ba882e528061a"
dependencies:
boom "4.x.x"
cryptiles "3.x.x"
hoek "4.x.x"
is-buffer@^1.0.2:
version "1.1.4"
resolved "https://registry.yarnpkg.com/is-buffer/-/is-buffer-1.1.4.tgz#cfc86ccd5dc5a52fa80489111c6920c457e2d98b"
isarray@~1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/isarray/-/isarray-1.0.0.tgz#bb935d48582cba168c06834957a54a3e07124f11"
isemail@2.x.x:
version "2.2.1"
resolved "https://registry.yarnpkg.com/isemail/-/isemail-2.2.1.tgz#0353d3d9a62951080c262c2aa0a42b8ea8e9e2a6"
items@2.x.x, items@^2.1.x:
version "2.1.1"
resolved "https://registry.yarnpkg.com/items/-/items-2.1.1.tgz#8bd16d9c83b19529de5aea321acaada78364a198"
joi@10.x.x:
version "10.2.2"
resolved "https://registry.yarnpkg.com/joi/-/joi-10.2.2.tgz#dc5a792b7b4c6fffa562242a95b55d9d3f077e24"
dependencies:
hoek "4.x.x"
isemail "2.x.x"
items "2.x.x"
topo "2.x.x"
joi@8.1.x:
version "8.1.1"
resolved "https://registry.yarnpkg.com/joi/-/joi-8.1.1.tgz#2d8b52a5d909d217ed47248577eefe8b1798f48f"
dependencies:
hoek "4.x.x"
isemail "2.x.x"
moment "2.x.x"
topo "2.x.x"
json-stringify-safe@5.0.x:
version "5.0.1"
resolved "https://registry.yarnpkg.com/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz#1296a2d58fd45f19a0f6ce01d65701e2c735b6eb"
kind-of@^3.0.2:
version "3.1.0"
resolved "https://registry.yarnpkg.com/kind-of/-/kind-of-3.1.0.tgz#475d698a5e49ff5e53d14e3e732429dc8bf4cf47"
dependencies:
is-buffer "^1.0.2"
lazy-cache@^1.0.3:
version "1.0.4"
resolved "https://registry.yarnpkg.com/lazy-cache/-/lazy-cache-1.0.4.tgz#a1d78fc3a50474cb80845d3b3b6e1da49a446e8e"
longest@^1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/longest/-/longest-1.0.1.tgz#30a0b2da38f73770e8294a0d22e6625ed77d0097"
lru-cache@4.0.x:
version "4.0.2"
resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-4.0.2.tgz#1d17679c069cda5d040991a09dbc2c0db377e55e"
dependencies:
pseudomap "^1.0.1"
yallist "^2.0.0"
mime-db@1.x.x:
version "1.26.0"
resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.26.0.tgz#eaffcd0e4fc6935cf8134da246e2e6c35305adff"
mimos@3.x.x:
version "3.0.3"
resolved "https://registry.yarnpkg.com/mimos/-/mimos-3.0.3.tgz#b9109072ad378c2b72f6a0101c43ddfb2b36641f"
dependencies:
hoek "4.x.x"
mime-db "1.x.x"
minimist@~0.0.1:
version "0.0.10"
resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.10.tgz#de3f98543dbf96082be48ad1a0c7cda836301dcf"
moment@2.15.x, moment@2.x.x:
version "2.15.2"
resolved "https://registry.yarnpkg.com/moment/-/moment-2.15.2.tgz#1bfdedf6a6e345f322fe956d5df5bd08a8ce84dc"
nes@^6.4.0:
version "6.4.0"
resolved "https://registry.yarnpkg.com/nes/-/nes-6.4.0.tgz#35831781df19cbe5a8014169bbd70887bc5c63d0"
dependencies:
boom "4.x.x"
call "3.x.x"
cryptiles "3.x.x"
hoek "4.x.x"
iron "4.x.x"
items "^2.1.x"
joi "10.x.x"
ws "1.x.x"
nigel@2.x.x:
version "2.0.2"
resolved "https://registry.yarnpkg.com/nigel/-/nigel-2.0.2.tgz#93a1866fb0c52d87390aa75e2b161f4b5c75e5b1"
dependencies:
hoek "4.x.x"
vise "2.x.x"
once@^1.3.1:
version "1.4.0"
resolved "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz#583b1aa775961d4b113ac17d9c50baef9dd76bd1"
dependencies:
wrappy "1"
once@~1.3.0:
version "1.3.3"
resolved "https://registry.yarnpkg.com/once/-/once-1.3.3.tgz#b2e261557ce4c314ec8304f3fa82663e4297ca20"
dependencies:
wrappy "1"
oppsy@1.x.x:
version "1.0.2"
resolved "https://registry.yarnpkg.com/oppsy/-/oppsy-1.0.2.tgz#98014cd6967653a83cfffa554226dc90050baad4"
dependencies:
hoek "4.x.x"
items "2.x.x"
optimist@^0.6.1:
version "0.6.1"
resolved "https://registry.yarnpkg.com/optimist/-/optimist-0.6.1.tgz#da3ea74686fa21a19a111c326e90eb15a0196686"
dependencies:
minimist "~0.0.1"
wordwrap "~0.0.2"
options@>=0.0.5:
version "0.0.6"
resolved "https://registry.yarnpkg.com/options/-/options-0.0.6.tgz#ec22d312806bb53e731773e7cdaefcf1c643128f"
pez@2.x.x:
version "2.1.4"
resolved "https://registry.yarnpkg.com/pez/-/pez-2.1.4.tgz#73f822fa62d599d65c4606f490d54d345191bc7c"
dependencies:
b64 "3.x.x"
boom "4.x.x"
content "3.x.x"
hoek "4.x.x"
nigel "2.x.x"
podium@^1.2.x:
version "1.2.5"
resolved "https://registry.yarnpkg.com/podium/-/podium-1.2.5.tgz#87c566c2f0365bcf0a1ec7602c4d01948cdd2ad5"
dependencies:
hoek "4.x.x"
items "2.x.x"
joi "10.x.x"
process-nextick-args@~1.0.6:
version "1.0.7"
resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-1.0.7.tgz#150e20b756590ad3f91093f25a4f2ad8bff30ba3"
pseudomap@^1.0.1:
version "1.0.2"
resolved "https://registry.yarnpkg.com/pseudomap/-/pseudomap-1.0.2.tgz#f052a28da70e618917ef0a8ac34c1ae5a68286b3"
pump@^1.0.0:
version "1.0.2"
resolved "https://registry.yarnpkg.com/pump/-/pump-1.0.2.tgz#3b3ee6512f94f0e575538c17995f9f16990a5d51"
dependencies:
end-of-stream "^1.1.0"
once "^1.3.1"
pumpify@1.3.x:
version "1.3.5"
resolved "https://registry.yarnpkg.com/pumpify/-/pumpify-1.3.5.tgz#1b671c619940abcaeac0ad0e3a3c164be760993b"
dependencies:
duplexify "^3.1.2"
inherits "^2.0.1"
pump "^1.0.0"
readable-stream@^2.0.0:
version "2.2.2"
resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.2.2.tgz#a9e6fec3c7dda85f8bb1b3ba7028604556fc825e"
dependencies:
buffer-shims "^1.0.0"
core-util-is "~1.0.0"
inherits "~2.0.1"
isarray "~1.0.0"
process-nextick-args "~1.0.6"
string_decoder "~0.10.x"
util-deprecate "~1.0.1"
repeat-string@^1.5.2:
version "1.6.1"
resolved "https://registry.yarnpkg.com/repeat-string/-/repeat-string-1.6.1.tgz#8dcae470e1c88abc2d600fff4a776286da75e637"
right-align@^0.1.1:
version "0.1.3"
resolved "https://registry.yarnpkg.com/right-align/-/right-align-0.1.3.tgz#61339b722fe6a3515689210d24e14c96148613ef"
dependencies:
align-text "^0.1.1"
shot@3.x.x:
version "3.4.0"
resolved "https://registry.yarnpkg.com/shot/-/shot-3.4.0.tgz#e7125ee72575ae5218349e933636808d790d4b92"
dependencies:
hoek "4.x.x"
joi "10.x.x"
source-map@^0.4.4:
version "0.4.4"
resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.4.4.tgz#eba4f5da9c0dc999de68032d8b4f76173652036b"
dependencies:
amdefine ">=0.0.4"
source-map@~0.5.1:
version "0.5.6"
resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.5.6.tgz#75ce38f52bf0733c5a7f0c118d81334a2bb5f412"
statehood@5.x.x:
version "5.0.1"
resolved "https://registry.yarnpkg.com/statehood/-/statehood-5.0.1.tgz#fc13c97b37751c18e70513d2b97e896ac8b73005"
dependencies:
boom "4.x.x"
cryptiles "3.x.x"
hoek "4.x.x"
iron "4.x.x"
items "2.x.x"
joi "10.x.x"
stream-shift@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/stream-shift/-/stream-shift-1.0.0.tgz#d5c752825e5367e786f78e18e445ea223a155952"
string_decoder@~0.10.x:
version "0.10.31"
resolved "https://registry.yarnpkg.com/string_decoder/-/string_decoder-0.10.31.tgz#62e203bc41766c6c28c9fc84301dab1c5310fa94"
subtext@^4.3.x:
version "4.3.0"
resolved "https://registry.yarnpkg.com/subtext/-/subtext-4.3.0.tgz#dfac90492ec35669fd6e00c6e5d938b06d7ccfbb"
dependencies:
boom "4.x.x"
content "3.x.x"
hoek "4.x.x"
pez "2.x.x"
wreck "10.x.x"
topo@2.x.x:
version "2.0.2"
resolved "https://registry.yarnpkg.com/topo/-/topo-2.0.2.tgz#cd5615752539057c0dc0491a621c3bc6fbe1d182"
dependencies:
hoek "4.x.x"
uglify-js@^2.6:
version "2.7.5"
resolved "https://registry.yarnpkg.com/uglify-js/-/uglify-js-2.7.5.tgz#4612c0c7baaee2ba7c487de4904ae122079f2ca8"
dependencies:
async "~0.2.6"
source-map "~0.5.1"
uglify-to-browserify "~1.0.0"
yargs "~3.10.0"
uglify-to-browserify@~1.0.0:
version "1.0.2"
resolved "https://registry.yarnpkg.com/uglify-to-browserify/-/uglify-to-browserify-1.0.2.tgz#6e0924d6bda6b5afe349e39a6d632850a0f882b7"
ultron@1.0.x:
version "1.0.2"
resolved "https://registry.yarnpkg.com/ultron/-/ultron-1.0.2.tgz#ace116ab557cd197386a4e88f4685378c8b2e4fa"
util-deprecate@~1.0.1:
version "1.0.2"
resolved "https://registry.yarnpkg.com/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"
vise@2.x.x:
version "2.0.2"
resolved "https://registry.yarnpkg.com/vise/-/vise-2.0.2.tgz#6b08e8fb4cb76e3a50cd6dd0ec37338e811a0d39"
dependencies:
hoek "4.x.x"
vision@^4.1.1:
version "4.1.1"
resolved "https://registry.yarnpkg.com/vision/-/vision-4.1.1.tgz#e1b612b2d2e2f20310a039290fd49d51248f82da"
dependencies:
boom "4.x.x"
hoek "4.x.x"
items "2.x.x"
joi "10.x.x"
window-size@0.1.0:
version "0.1.0"
resolved "https://registry.yarnpkg.com/window-size/-/window-size-0.1.0.tgz#5438cd2ea93b202efa3a19fe8887aee7c94f9c9d"
wordwrap@0.0.2:
version "0.0.2"
resolved "https://registry.yarnpkg.com/wordwrap/-/wordwrap-0.0.2.tgz#b79669bb42ecb409f83d583cad52ca17eaa1643f"
wordwrap@~0.0.2:
version "0.0.3"
resolved "https://registry.yarnpkg.com/wordwrap/-/wordwrap-0.0.3.tgz#a3d5da6cd5c0bc0008d37234bbaf1bed63059107"
wrappy@1:
version "1.0.2"
resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
wreck@10.x.x:
version "10.0.0"
resolved "https://registry.yarnpkg.com/wreck/-/wreck-10.0.0.tgz#98ab882f85e16a526332507f101f5a7841162278"
dependencies:
boom "4.x.x"
hoek "4.x.x"
ws@1.x.x:
version "1.1.2"
resolved "https://registry.yarnpkg.com/ws/-/ws-1.1.2.tgz#8a244fa052401e08c9886cf44a85189e1fd4067f"
dependencies:
options ">=0.0.5"
ultron "1.0.x"
yallist@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/yallist/-/yallist-2.0.0.tgz#306c543835f09ee1a4cb23b7bce9ab341c91cdd4"
yargs@~3.10.0:
version "3.10.0"
resolved "https://registry.yarnpkg.com/yargs/-/yargs-3.10.0.tgz#f7ee7bd857dd7c1d2d38c0e74efbd681d1431fd1"
dependencies:
camelcase "^1.0.2"
cliui "^2.1.0"
decamelize "^1.0.0"
window-size "0.1.0"
Chapter08/web-server-hardening/http-app/index.js
-25
View File
@@ -1,25 +0,0 @@
const http = require('http')
const server = http.createServer((req, res) => {
secureHeaders(res)
switch (req.url) {
case '/': return res.end('hello world')
case '/users': return res.end('oh, some users!')
default: return error('404', res)
}
})
function secureHeaders (res) {
res.setHeader('X-DNS-Prefetch-Control', 'off')
res.setHeader('X-Frame-Options', 'SAMEORIGIN')
res.setHeader('X-Download-Options', 'noopen')
res.setHeader('X-Content-Type-Options', 'nosniff')
res.setHeader('X-XSS-Protection', '1; mode=block')
}
function error(code, res) {
res.statusCode = code
res.end(http.STATUS_CODES[code])
}
server.listen(3000)
Chapter08/web-server-hardening/koa-app/app.js
-61
View File
@@ -1,61 +0,0 @@
const Koa = require('koa')
const helmet = require('koa-helmet')
const app = new Koa()
const router = require('koa-router')()
const views = require('koa-views')
const co = require('co')
const json = require('koa-json')
const onerror = require('koa-onerror')
const bodyparser = require('koa-bodyparser')
const serve = require('koa-static')
const path = require('path')
const log4js = require('koa-log4')
const logger = log4js.getLogger('app')
const index = require('./routes/index')
const users = require('./routes/users')
// middlewares
app.use(helmet())
app.use(bodyparser())
app.use(json())
app.use(log4js.koaLogger(log4js.getLogger('http'), { level: 'auto' }))
app.use(serve(path.join(__dirname, 'public')))
// handle error
onerror(app)
// setup view
app.use(views(path.join(__dirname, 'views'), {
extension: 'jade'
}))
// logger
// app.use(async (ctx, next) => {
// const start = new Date()
// await next()
// const ms = new Date() - start
// logger.info(`${ctx.method} ${ctx.url} - ${ms}ms`)
// })
app.use(co.wrap(function * (ctx, next) {
const start = new Date()
yield next()
const ms = new Date() - start
logger.info(`${ctx.method} ${ctx.url} - ${ms}ms`)
}))
// routes definition
router.use('/', index.routes(), index.allowedMethods())
router.use('/users', users.routes(), users.allowedMethods())
// mount root routes
app.use(router.routes())
.use(router.allowedMethods())
// log error
app.on('error', function (err, ctx) {
logger.error(err)
logger.error('server error', err, ctx)
})
module.exports = app
Chapter08/web-server-hardening/koa-app/bin/www
-106
View File
@@ -1,106 +0,0 @@
#!/usr/bin/env node
/**
* Module dependencies.
*/
const app = require('../app')
const http = require('http')
const path = require('path')
const appDir = path.resolve(__dirname, '..')
const logDir = path.join(appDir, 'logs')
/**
* make a log directory, just in case it isn't there.
*/
try {
require('fs').mkdirSync(logDir)
} catch (e) {
if (e.code !== 'EEXIST') {
console.error('Could not set up log directory, error was: ', e)
process.exit(1)
}
}
const log4js = require('koa-log4')
log4js.configure(path.join(appDir, 'log4js.json'), { cwd: logDir })
const logger = log4js.getLogger('startup')
/**
* Get port from environment and store in Express.
*/
var port = normalizePort(process.env.PORT || '3000')
// app.set('port', port)
/**
* Create HTTP server.
*/
var server = http.createServer(app.callback())
/**
* Listen on provided port, on all network interfaces.
*/
server.listen(port)
server.on('error', onError)
server.on('listening', onListening)
/**
* Normalize a port into a number, string, or false.
*/
function normalizePort (val) {
var port = parseInt(val, 10)
if (isNaN(port)) {
// named pipe
return val
}
if (port >= 0) {
// port number
return port
}
return false
}
/**
* Event listener for HTTP server "error" event.
*/
function onError (error) {
if (error.syscall !== 'listen') {
throw error
}
var bind = typeof port === 'string'
? 'Pipe ' + port
: 'Port ' + port
// handle specific listen errors with friendly messages
switch (error.code) {
case 'EACCES':
logger.error(bind + ' requires elevated privileges')
process.exit(1)
break
case 'EADDRINUSE':
logger.error(bind + ' is already in use')
process.exit(1)
break
default:
throw error
}
}
/**
* Event listener for HTTP server "listening" event.
*/
function onListening () {
var addr = server.address()
var bind = typeof addr === 'string'
? 'pipe ' + addr
: 'port ' + addr.port
logger.info('Listening on ' + bind)
}
Chapter08/web-server-hardening/koa-app/gulpfile.js
-66
View File
@@ -1,66 +0,0 @@
var gulp = require('gulp')
var nodemon = require('gulp-nodemon')
var sourcemaps = require('gulp-sourcemaps')
var concat = require('gulp-concat')
var uglify = require('gulp-uglify')
var cssmin = require('gulp-cssmin')
var del = require('del')
var path = require('path')
var client = {
js: {
src: 'client/js',
dest: 'public/js'
},
css: {
src: 'client/css',
dest: 'public/css'
}
}
gulp.task('default', ['jsmin', 'cssmin', 'start'])
gulp.task('start', function () {
nodemon({
script: 'bin/www',
ext: 'js css ejs',
ignore: ['public', 'logs'],
tasks: function (files) {
var tasks = []
files.forEach(function (file) {
if (path.relative(client.js.src, file).substr(0, 2) !== '..'
&& !~tasks.indexOf('jsmin')) {
tasks.push('jsmin')
}
if (path.relative(client.css.src, file).substr(0, 2) !== '..'
&& !~tasks.indexOf('cssmin')) {
tasks.push('cssmin')
}
})
return tasks
}
})
})
gulp.task('cleanjs', function () {
return del([client.js.dest])
})
gulp.task('cleancss', function () {
return del([client.css.dest])
})
gulp.task('jsmin', ['cleanjs'], function () {
return gulp.src(client.js.src + '/**/*.js')
.pipe(sourcemaps.init())
.pipe(concat('graph.js'))
.pipe(uglify())
.pipe(gulp.dest(client.js.dest))
})
gulp.task('cssmin', ['cleancss'], function () {
return gulp.src(client.css.src + '/**/*.css')
.pipe(concat('style.css'))
.pipe(cssmin())
.pipe(gulp.dest(client.css.dest))
})
Chapter08/web-server-hardening/koa-app/log4js.json
-38
View File
@@ -1,38 +0,0 @@
{
"appenders": [
{
"type": "console"
},
{
"type": "clustered",
"appenders": [
{
"type": "dateFile",
"filename": "startup.log",
"pattern": "-yyyy-MM-dd",
"category": "startup"
},
{
"type": "dateFile",
"filename": "http.log",
"pattern": "-yyyy-MM-dd",
"category": "http"
},
{
"type": "file",
"filename": "app.log",
"maxLogSize": 10485760,
"numBackups": 5
},
{
"type": "logLevelFilter",
"level": "ERROR",
"appender": {
"type": "file",
"filename": "errors.log"
}
}
]
}
]
}
Chapter08/web-server-hardening/koa-app/package.json
-31
View File
@@ -1,31 +0,0 @@
{
"name": "koa-app",
"version": "0.0.0",
"private": true,
"scripts": {
"start": "node ./bin/www",
"test": "gulp"
},
"dependencies": {
"co": "^4.6.0",
"jade": "~1.11.0",
"koa": "^2.0.0",
"koa-bodyparser": "^3.0.0",
"koa-helmet": "^3.1.0",
"koa-json": "^2.0.0",
"koa-log4": "^2.0.1",
"koa-onerror": "^1.2.1",
"koa-router": "^7.0.0",
"koa-static": "^3.0.0",
"koa-views": "^5.0.1"
},
"devDependencies": {
"del": "^2.2.0",
"gulp": "^3.9.1",
"gulp-concat": "^2.6.0",
"gulp-cssmin": "^0.1.7",
"gulp-nodemon": "^2.0.6",
"gulp-sourcemaps": "^1.6.0",
"gulp-uglify": "^1.5.3"
}
}
Chapter08/web-server-hardening/koa-app/public/stylesheets/style.css
-8
View File
@@ -1,8 +0,0 @@
body {
padding: 50px;
font: 14px "Lucida Grande", Helvetica, Arial, sans-serif;
}
a {
color: #00B7FF;
}
Chapter08/web-server-hardening/koa-app/routes/index.js
-19
View File
@@ -1,19 +0,0 @@
const co = require('co')
const router = require('koa-router')()
router.get('/', co.wrap(function *(ctx, next) {
ctx.state = {
title: 'Welcome to Koa'
}
yield ctx.render('index', {})
}))
// router.get('/', async function (ctx, next) {
// ctx.state = {
// title: 'koa2 title'
// }
//
// await ctx.render('index', {
// })
// })
module.exports = router
Chapter08/web-server-hardening/koa-app/routes/users.js
-7
View File
@@ -1,7 +0,0 @@
const router = require('koa-router')()
router.get('/', function (ctx, next) {
ctx.body = 'this a users response!'
})
module.exports = router
Chapter08/web-server-hardening/koa-app/views/error.jade
-6
View File
@@ -1,6 +0,0 @@
extends layout
block content
h1= message
h2= error.status
pre #{error.stack}
Chapter08/web-server-hardening/koa-app/views/index.jade
-5
View File
@@ -1,5 +0,0 @@
extends layout
block content
h1= title
p Welcome to #{title}
Chapter08/web-server-hardening/koa-app/views/layout.jade
-7
View File
@@ -1,7 +0,0 @@
doctype html
html
head
title= title
link(rel='stylesheet', href='/stylesheets/style.css')
body
block content