Path to image in Ubuntu server - node.js

I'm working on a project that involves both front-end (react.js) and back-end (node.js). The back-end had been uploaded to AWS.
I'm trying to fetch an image stored in the back-end.
Assuming the path to the image in AWS is : /home/ubuntu/path/to/image.jpg
and the url for the back-end is: 123.123.123.123:4000
How can I fetch the image?
Running a GET request in Postman with the following url -
http://123.123.123.123:4000/home/ubuntu/path/to/image.jpg
resolves in a Cannot GET error.

Usually any files you wish to serve need to be in the web root of the server. You don't say, at all, how your AWS Ubuntu server is configured so it is really hard to say what the path should be.
In general though the web root would be something like /var/www/public/ - so using that as an example you would need to move your images into this path - e.g. /var/www/public/path/to/image.jpg
Then the URL to the image would be 123.123.123.123:4000/path/to/image.jpg
In general, without an Alias or symlink with FollowSymLinks or some such, any file you wish to serve needs to be in the web root of the server and resources outside of this path are not web accessible - for obvious security reasons.
You could try and Alias the path to your images into the web root i.e. Alias /home/ubuntu/path/to/ /var/www/public/images/ which should make the path to the image 123.123.123.123:4000/images/image.jpg however, again, this would depend on your server set-up.

Related

Are the security implications of installing NodeJS in the public HTML folder?

I'm running NodeJS for my server-side javascripting, but serving my pages with Apache.
My pages currently reference Socket.IO locally, in that they load the node_modules/socket.io-client/dist/socket.io.js from the /var/www/html
The NodeJS index.js file also resides in /var/www/html which has become a problem for me.
Can I move my NodeJS index.js file to var/www so it is no longer publicly accessible, without needing to move node_modules from var/www/html which Socket.IO is relying on to be publicly accessible?
When using Node.js to serve the Webpage:
Your servers root directory is typically not publicly visible. Requests to your server get handled by the routes you set up in the index.js file. By default, no files are accessible. However, if you need a public folder (e.g. for the favicon file or an index.html file), I would recommend creating a subfolder in your root directory and use for example express to make it available.
When not using Node.js to serve the Webpage:
If you need Node.js for client-side logic, you should just use normal javascript (for example this in the case of WebSockets). Node.js is a serverside application where you run javascript on the server. So on the client-side, there is no need for Node.js. If you need certain npm packages, SubStack on GitHub has a module called node-browserify. It will compress and bundle your modules and deliver it as a single js file, but you use it just like Node.js.
If you need Node.js for server-side logic, then there is no need to make it publicly available and you should change your current server configuration to not make it accessible from the browser.

How do I use AWS S3 to host a static express/nodeJS page?

I am new to nodejs/express/coding in general so my apologies if this isn't extremely clear. I am doing a code challenge for a job.
I have most of the project done. Part of the challenge is to have it uploaded to a bucket on S3. I created a bucket, that is all done. My problem is there needs to be a index.html in the root folder of the bucket (I think). All of my html pages (three of them) sit inside of the views directory. When I try to put my index.html in the root folder on cloud9, it says index.html can't be found in the views directory (obviously, since I moved it out). Can I set the views directory to be in the root folder?
Is there a way with express/nodeJS to have all of the files in the root folder? Or is there a way to keep my views folder as it is in Cloud9 and have everything run like it does from there, except in S3? I must be missing something. I am completely lost as to how to host this app on S3. Posting on here was my last resort! Thanks for any help.
Let's make order. Amazon S3 is a cloud file storage service. It can also be used to host static assets of a website.
From what I understand, you are building something with express, using the view directory, used in general for templates and so, I suppose, you are rendering your html pages by your express application. This is called server side rendering and is fully incompatible with amazon s3 that can only serve files.
Now, how can you resolve the problem (considering that you are obliged to use s3)? It depends.
If you are using express only to render your application and to serve static assets (so no API), you should consider some refactoring: in such case, you are basically building a web application without APIs. You don't need express. Maybe you are searching for a client side framework like Vue.js, React or Angular. To be more general, you should render your application client side.
If your express server is also acting as api server, you should divide your project. From one side you have your express api server, deployed somewhere. From the other side, you have your web app, client side rendered.
There is another solution: you could use a prerender like this to generate static assets from your express application. But if you are new to web developement, I advise you not to evaluate this option
When you move your static files to S3, you will need to setup the relative paths accordingly.
Can I set the views directory to be in the root folder?
No. Instead organize your files in S3 where index.html is the root and files with paths such as js/ css/ images/ taken from the root folder.
Note: Its important to understand that you cannot run NodeJS in S3 and instead you will be using the internal web hosting from S3 to serve the static content.

Messenger bot - Sample code

I am trying to create a bot. Using this project. My setup is as follows:
Amazon EC2 instance. I created a sub-domain.domain.com I have added the ssl certifications. I have pointed the sub-domain to the /var/www/sub-domain/
I have installed the unzip and installed the project in /var/www/sub-domain/project/ I have configured the project and correctly run it:
Node app is running on port 5000
If I access http://sub-domain.domain.com:5000 I access to the projects public index. I understand that means the port is open and the node app works.
Now when I am trying to configure in facebook my webhook I dont understand what url callbak to use. From what I understand in the configuration the server url whould be https://sub-domain.domain.com and the configuration should work. but it doesnt.
What url should I use?
Your callback URL should be your actual file where facebook would send user data. Like if you were using PHP, you'd say: http://yourhost/chatbot.php. Currently, webhook would be the URL on which your node app is listening.
Your webhook needs to an accessible URL. I don't know which sample code you used, but my guess is that with your current set up you should use http://sub-domain.domain.com:5000/webhook.
You can use Apache or Nginx to make it accessible on http://sub-domain.domain.com/webhook (port 80) with ProxyPass/proxy_pass directives.
I have installed the unzip and installed the project in /var/www/sub-domain/project/ [...] I access to the projects public index
The Javascript files of your project don't need to and should not be accessible to the public, as they may contain your application's secret IDs and tokens.

Saving and accessing files on a mounted drive in nodejs

I have 3 servers running as a cluster managed by flynn (a bit like heroku) which I can attach a shared drive to so that in theory they all have access to the same files.
However I'm a bit unsure if it's possible to access a mounted drive from my nodejs app to save and access files.
Can anyone shed some light on if this is possible and roughly how I'd go about doing it.
With node.js, your file system path has literally nothing to do with the URLs that your server supports. node.js servers do not serve ANY files by default (unlike some other servers).
If you want an incoming browser request for http://example.com/uploads/test.jpg to read a file from /mnt/shared/uploads, then you have to create a web server route handler that includes the incoming path http://example.com/uploads/test.jpg and then reads the data from /mnt/shared/uploads and writes that data out as the http response.
Depending upon what web server environment you are using, there are helpers to do that mapping. For example, express has express.static() that helps with some auto mapping. But, the web server by itself does not server any files like this automatically.
So, if what you want is that all incoming requests for http://example.com/uploads/* will be read from /mnt/shared/uploads/*, then you can use express.static() to help you do that like this:
app.use("/uploads", express.static("/mnt/shared/uploads"));
This will take any path it finds after /uploads and look for that path in /mnt/shared/uploads. If found, it will automatically serve the content as static content.
So, it would work like this with the incoming URL shown first and the place express.static() would look for a matching file:
/uploads/test.jpg ==> /mnt/shared/uploads/test.jpg
/uploads/bob/test.txt ==> /mnt/shared/uploads/bob/test.txt

[NodeJS]Is my backend code secured?

I'd like to create a simple site on NodeJS. For example, it has two files (app.js - main application file) and router,js (a url file). I'd like to know - if it possibke for anyone just to access mydomain.com/router.js to get the source code of my application? I'm asking 'cause for example in PHP you cant just access to php, as you know server just gives you the result of working of this PHP-file, but not the file itself. So, how to make my nodejs-app invisible for public access? Thanks!
I make sure that all files for Node.js are never in a path that is served by another web server such as Apache. That way, there is little danger of the source ever being served by accident.
My node program's and files go in /var/nodejs with a sub-folder for each application in Node. By default of course, Node will not serve ANYTHING unless you tell it to.
At the root of my Apache configuration, I make sure that ALL folders are secured so that I explicitly have to enable serving on any folder structure even under the /var/www folders that I use for all Apache sites.
So you are pretty safe with a default setup of Node and Apache as long as you keep the folders separate. Also Node will not serve source code accidentally, you would have to set up a Node server that read the file as text and wrote it to the http stream.
That depends on how you are using Node.js and what you are using for a web server in front of it. Unlike PHP running as CGI or as a module in Apache, node and the node application itself is a server.
If you have a webserver with your node source directory exposed then the url you provided in the question will most likely result in your source code being served. Even if you were using Apache and proxying to node, there is usually no output filter involved. Instead requests are passed to the backend node server which interprets them.

Resources