How to extract secrets from running node app via debugger - node.js

I'm trying to hack my own node app and extract secrets from it by attaching a debugger to the running process. It's a NestJS / Express app.
So there is a compiled main.ts file of the same form as here running.
I am attaching a debugger via node inspect -p $PID. I can now go into a repl, but from there I don't know how to access the instantiated NestJS objects...
There is a ConfigService class from which I would like to retrieve the variables.
How would I continue here?

Related

How to see process.env after starting server

I am developing sample apps and would like to know process.env variables,
I know console.log(process.env) will return its variables.
But can I see them after run its server ?
npm start
I couldn't input anything in console.
As I am new to node.js, will you please let me know.
by switing NODE_ENV, it seems that development,staging,production is switched.
So that I would like to comfirm them.
Thanks
If you start your server in docker and don't pass custom variables to process.env in your app, you can see your env by docker command:
docker exec your_container env
Yet another way - create a specific route in your application that will be return you all data from process.env.
Something like this:
GET yourserver/api/system/env
But this way is not secured and you should think about protection of your system route.
UPD
Also you can call console.log(process.env) after server has been started.
await app.listen(3000);
console.log(process.env);

Vercel build never ends

I'm having a problem with Vercel platform, probably because I'm not using it right.
Locally I can deploy the server without problems on port 3000.
But when I want to deploy in Vercel, Build gets stuck at the express function app.listen().
Image Vercel error:
My index.js is like any other and ends with the function:
// listening the server
app.listen(app.get('port'), () => {
console.log('Server on port ', app.get('port'));
});
I've tried everything I don't know what to do anymore, surely I have a conceptual error.
Vercel is for front-end (and serverless)
Sites deployed on Vercel are mainly front-end. (React, Vue, and everything else that becomes HTML/CSS/JS).
By the looks of it you're trying to run a back-end application (Node.js) on Vercel, which it isn't designed for. (Instead, consider using a VPS or a managed environment/app platform)
Vercel also supports serverless functions, which you could use to run your back-end with. These are essentially one-off functions that are run on a new server instance every time a request comes in.
All that considered, if you're indeed trying to build and deploy a front-end app...
A wild guess
Your build script is calling your node application. You might have something like the following in your package.json:
"scripts": {
"build": "tsc && node src"
}
This would run tsc first, then start the application by running the built files.
However, you don't want to start your application as part of the build process -- instead, make the build command only build your app, nothing more.
Then, on Vercel, go to your project's settings page and make sure that command is used to Build your app.
My app doesn't need to be built (I've already got plain HTML/CSS/JS files)
If your app doesn't need to be built at all, go to your project's settings page and remove the "Build Command" entirely.

Make a logger for Node Js

I have a project in Node Js, which executes the project on port 3000 and I access from ngrok with my browser to said localhost port, and it executes a server on port 3001 to make requests to a Maria database db. The project is done in react and the server with express.
I want to save the application logs (errors, warnings, etc.) in a log file so that I can see them whenever I want.
My intention was to use winston, and while I have no problem on the server side (3001), when I try to adapt it to the main project, I get an error that it cannot save files (the reason that appears is that it runs from the browser, and you can't create such a file because you don't have access to the project folders)
Can anyone give me some advice? Am I wrong to use winston, and should I use another?
Greetings and thanks
I've never used winston before and I couldn't find anything online about your error. In the past I've always just used node's fs module to create a log of errors and restarts.
const fs = require('fs')
Node's File System Documentation: https://nodejs.dev/learn/the-nodejs-fs-module
Short YouTube Tutorial: https://www.youtube.com/watch?v=U57kU311-nE

fs.existsSync is not a function error when requiring grpc through create-react-app

We are trying to get gRPC to work with React (actually we were trying to get it to work with React-Native but gave up on that for now).
Using plain node.js things are pretty straight forward if you follow this example.
We started by using create-react-app but when we started the app, we got the following error:
existsSync is not a function
That was casued by this bit in pre-binding.js belonging to the node-pre-gyp package located in grpc:
var existsSync = require('fs').existsSync || require('path').existsSync;
My understanding is that something goes on with Webpack (or some other process run by create-react-app) that goes and returns and empty object instead of require('fs').
Any ideas of how to get this to work without having to give up on the wonders of create-react-app?
To test it out you can just follow these 2 easy steps:
create-react-app test-app
add import grpc from 'grpc'; in the App.js file
Basically, from what I understand now, you are not really supposed to use gRPC + Protobuf directly from any frontend but rather it is more common to use the grpc node package on node.js server-side code and then communicate with the browser-side code using Express.
The server-side code on node.js then communicates using grpc with the microservices.
We are testing out the use of Firebase Functions to communicate securely with the frontend and Firebase Functions communicate with the Go microservices using grpc.

Use test database with grunt and mocha

I am building a web app in Node.js, Express, and MongoDB using Mongoose. I want to have a dedicated database for when i run my Mocha tests with Grunt so that I do not mess up the database I am using for development. How would I do this?
I currently have my development database configuration information in a file at /config/db.js, which is loaded and connecting to my development database in my app.js file at startup. How would I make my Mocha tests, that are run in a Grunt task, use a test database dynamically when I run Grunt? I have tried to disconnect from development database in my test files in the before() hook in my Mocha test files, and then connect to test database. However, it keeps using development database. An example is the following:
before(function(done) {
if(mongoose.connection.db) mongoose.connection.close();
mongoose.connect(<test_db_uri>, done);
}
Your question is near of the following question Test environment in Node.js / Express application.
Basicly what you should do is use an env variable ('NODE_ENV' for exemple) access it with process.env.NODE_ENV and base on its value call the right configuration file. You should take a look to grunt-express-server which helps you a lot with the environement setup.
I hop this will help!

Resources