Node - Express 4 csrf - node.js

With the dawn of Express 4 connect is no longer a dependancy. I can't find on the express site any new implementation of csrf.
the old way was app.use(express.csrf()); and then add in a middleware function to expose it in the view.
My question is: Am I now forced to include connect as a dependency, or is there something baked into express now that allows for csrf that I am missing?
Or can I just include the source of csrf into my app?

You can install and require csurf for Express 4.

Related

Express.js POST request returns 404 [duplicate]

Despite knowing JavaScript quite well, I'm confused what exactly these three projects in Node.js ecosystem do. Is it something like Rails' Rack? Can someone please explain?
[Update: As of its 4.0 release, Express no longer uses Connect. However, Express is still compatible with middleware written for Connect. My original answer is below.]
I'm glad you asked about this, because it's definitely a common point of confusion for folks looking at Node.js. Here's my best shot at explaining it:
Node.js itself offers an http module, whose createServer method returns an object that you can use to respond to HTTP requests. That object inherits the http.Server prototype.
Connect also offers a createServer method, which returns an object that inherits an extended version of http.Server. Connect's extensions are mainly there to make it easy to plug in middleware. That's why Connect describes itself as a "middleware framework," and is often analogized to Ruby's Rack.
Express does to Connect what Connect does to the http module: It offers a createServer method that extends Connect's Server prototype. So all of the functionality of Connect is there, plus view rendering and a handy DSL for describing routes. Ruby's Sinatra is a good analogy.
Then there are other frameworks that go even further and extend Express! Zappa, for instance, which integrates support for CoffeeScript, server-side jQuery, and testing.
Here's a concrete example of what's meant by "middleware": Out of the box, none of the above serves static files for you. But just throw in connect.static (a middleware that comes with Connect), configured to point to a directory, and your server will provide access to the files in that directory. Note that Express provides Connect's middlewares also; express.static is the same as connect.static. (Both were known as staticProvider until recently.)
My impression is that most "real" Node.js apps are being developed with Express these days; the features it adds are extremely useful, and all of the lower-level functionality is still there if you want it.
The accepted answer is really old (and now wrong). Here's the information (with source) based on the current version of Connect (3.0) / Express (4.0).
What Node.js comes with
http / https createServer which simply takes a callback(req,res) e.g.
var server = http.createServer(function (request, response) {
// respond
response.write('hello client!');
response.end();
});
server.listen(3000);
What connect adds
Middleware is basically any software that sits between your application code and some low level API. Connect extends the built-in HTTP server functionality and adds a plugin framework. The plugins act as middleware and hence connect is a middleware framework
The way it does that is pretty simple (and in fact the code is really short!). As soon as you call var connect = require('connect'); var app = connect(); you get a function app that can:
Can handle a request and return a response. This is because you basically get this function
Has a member function .use (source) to manage plugins (that comes from here because of this simple line of code).
Because of 1.) you can do the following :
var app = connect();
// Register with http
http.createServer(app)
.listen(3000);
Combine with 2.) and you get:
var connect = require('connect');
// Create a connect dispatcher
var app = connect()
// register a middleware
.use(function (req, res, next) { next(); });
// Register with http
http.createServer(app)
.listen(3000);
Connect provides a utility function to register itself with http so that you don't need to make the call to http.createServer(app). Its called listen and the code simply creates a new http server, register's connect as the callback and forwards the arguments to http.listen. From source
app.listen = function(){
var server = http.createServer(this);
return server.listen.apply(server, arguments);
};
So, you can do:
var connect = require('connect');
// Create a connect dispatcher and register with http
var app = connect()
.listen(3000);
console.log('server running on port 3000');
It's still your good old http.createServer with a plugin framework on top.
What ExpressJS adds
ExpressJS and connect are parallel projects. Connect is just a middleware framework, with a nice use function. Express does not depend on Connect (see package.json). However it does the everything that connect does i.e:
Can be registered with createServer like connect since it too is just a function that can take a req/res pair (source).
A use function to register middleware.
A utility listen function to register itself with http
In addition to what connect provides (which express duplicates), it has a bunch of more features. e.g.
Has view engine support.
Has top level verbs (get/post etc.) for its router.
Has application settings support.
The middleware is shared
The use function of ExpressJS and connect is compatible and therefore the middleware is shared. Both are middleware frameworks, express just has more than a simple middleware framework.
Which one should you use?
My opinion: you are informed enough ^based on above^ to make your own choice.
Use http.createServer if you are creating something like connect / expressjs from scratch.
Use connect if you are authoring middleware, testing protocols etc. since it is a nice abstraction on top of http.createServer
Use ExpressJS if you are authoring websites.
Most people should just use ExpressJS.
What's wrong about the accepted answer
These might have been true as some point in time, but wrong now:
that inherits an extended version of http.Server
Wrong. It doesn't extend it and as you have seen ... uses it
Express does to Connect what Connect does to the http module
Express 4.0 doesn't even depend on connect. see the current package.json dependencies section
node.js
Node.js is a javascript motor for the server side.
In addition to all the js capabilities, it includes networking capabilities (like HTTP), and access to the file system.
This is different from client-side js where the networking tasks are monopolized by the browser, and access to the file system is forbidden for security reasons.
node.js as a web server: express
Something that runs in the server, understands HTTP and can access files sounds like a web server. But it isn't one.
To make node.js behave like a web server one has to program it: handle the incoming HTTP requests and provide the appropriate responses.
This is what Express does: it's the implementation of a web server in js.
Thus, implementing a web site is like configuring Express routes, and programming the site's specific features.
Middleware and Connect
Serving pages involves a number of tasks. Many of those tasks are well known and very common, so node's Connect module (one of the many modules available to run under node) implements those tasks.
See the current impressing offering:
logger request logger with custom format support
csrf Cross-site request forgery protection
compress Gzip compression middleware
basicAuth basic http authentication
bodyParser extensible request body parser
json application/json parser
urlencoded application/x-www-form-urlencoded parser
multipart multipart/form-data parser
timeout request timeouts
cookieParser cookie parser
session session management support with bundled MemoryStore
cookieSession cookie-based session support
methodOverride faux HTTP method support
responseTime calculates response-time and exposes via X-Response-Time
staticCache memory cache layer for the static() middleware
static streaming static file server supporting Range and more
directory directory listing middleware
vhost virtual host sub-domain mapping middleware
favicon efficient favicon server (with default icon)
limit limit the bytesize of request bodies
query automatic querystring parser, populating req.query
errorHandler flexible error handler
Connect is the framework and through it you can pick the (sub)modules you need.
The Contrib Middleware page enumerates a long list of additional middlewares.
Express itself comes with the most common Connect middlewares.
What to do?
Install node.js.
Node comes with npm, the node package manager.
The command npm install -g express will download and install express globally (check the express guide).
Running express foo in a command line (not in node) will create a ready-to-run application named foo. Change to its (newly created) directory and run it with node with the command node <appname>, then open http://localhost:3000 and see.
Now you are in.
Connect offers a "higher level" APIs for common HTTP server functionality like session management, authentication, logging and more. Express is built on top of Connect with advanced (Sinatra like) functionality.
Node.js itself offers an HTTP module, whose createServer method returns an object that you can use to respond to HTTP requests. That object inherits the http.Server prototype.
Related information, especially if you are using NTVS for working with the Visual Studio IDE. The NTVS adds both NodeJS and Express tools, scaffolding, project templates to Visual Studio 2012, 2013.
Also, the verbiage that calls ExpressJS or Connect as a "WebServer" is incorrect. You can create a basic WebServer with or without them. A basic NodeJS program can also use the http module to handle http requests, Thus becoming a rudimentary web server.
middleware as the name suggests actually middleware is sit between middle.. middle of what? middle of request and response..how request,response,express server sit in express app
in this picture you can see requests are coming from client then the express server server serves those requests.. then lets dig deeper.. actually we can divide this whole express server's whole task in to small seperate tasks like in this way.
how middleware sit between request and response small chunk of server parts doing some particular task and passed request to next one.. finally doing all the tasks response has been made..
all middle ware can access request object,response object and next function of request response cycle..
this is good example for explaining middleware in express youtube video for middleware
The stupid simple answer
Connect and Express are web servers for nodejs. Unlike Apache and IIS, they can both use the same modules, referred to as "middleware".

Can I implement passport js into my back-end express app

I'm new to node,so this maybe be a silly question but I would like to know if it is possible to implement the api passport js into my back-end express app ?
Yup: here's a tutorial on it: https://blog.risingstack.com/node-hero-node-js-authentication-passport-js/
I have found a good tutorial where I was able to get passport js to work on the back-end
https://scotch.io/tutorials/authenticate-a-node-js-api-with-json-web-tokens

Swagger generate Node.JS Express server code

I have Swagger 2.0 documentation, and I would like to create a Node.JS server stub from the existing Swagger spec.
When I use the Swagger Editor, it has the option to generate Node.js server stubs, but the generated file uses the connect NPM libraries.
I would prefer to use Express, and have the application folder structure of a general Express application. Is there a way to modify the generation of the Node.JS server stub to be compatible with Express?
The easy answer is to change var app = require('connect')(); to var app = require('express')(); in nodejs-server-server/index.js. But it's not optimal since the generated code does not take use of the functionality of Express.
It seems like there will be a express code generator in the next version of swagger-codegen.
You could also use swaggerize-express to do the server stub generation.

Usage of cookie-parser with passport.js still needed?

Can not find any info (on passport.js site) about general passport.js instalation and declaration in node.js.
In the tutorials I always see express session middleware and cookie-parser stated as required for passport, yet session docs (https://github.com/expressjs/session) notes:
'Since version 1.5.0, the cookie-parser middleware no longer needs to be used for this module to work. This module now directly reads and writes cookies on req/res. Using cookie-parser may result in issues if the secret is not the same between this module and cookie-parser.'
So do I need to use session & cookie-parser for passport for some reasons, or I can use only session, am I need to tweak something then?
No, passport itself does not require cookie-parser middleware. If you want session-persistent authentication then you'll need the express-session middleware, which used to require cookie-parser, but modern versions of express no longer have this requirement (the current version of express-session reads and writes cookies directly).

What are the differences between Koa and Express 4.0?

Koa and Express 4.0 are both fairly new, and from what I've read, Koa was made by the Express team.
From what I understand, Koa requires features of node that are only available in 0.11 (the unstable branch) of node, and also uses generators. Express 4.0 seems to only be the next version of the Express framework.
Are there any differences I am missing completely? Is it likely (based on what the Express team has publicly stated) that Koa and Express will merge at some point in the future?
Thanks!
Search engines should be your first resort before posting open-ended questions.
From the Koa docs:
Koa vs Express
Philosophically, Koa aims to "fix and replace node", whereas Express "augments node". Koa uses co to rid apps of callback
hell and simplify error handling. It exposes its own this.request and
this.response objects instead of node's req and res objects.
Express, on the other hand, augments node's req and res objects with
additional properties and methods and includes many other "framework"
features, such as routing and templating, which Koa does not.
Thus, Koa can be viewed as an abstraction of node.js's http modules,
where as Express is an application framework for node.js.
...
Does Koa replace Express?
It's more like Connect, but a lot of the Express goodies were moved to
the middleware level in Koa to help form a stronger foundation. This
makes middleware more enjoyable and less error-prone to write, for the
entire stack, not just the end application code.
Typically many middleware would re-implement similar features, or even
worse incorrectly implement them, when features like signed cookie
secrets among others are typically application-specific, not
middleware specific.
...
Why isn't Koa just Express 4.0?
Koa is a pretty large departure from what people know about Express,
the design is fundamentally much different, so the migration from
Express 3.0 to this Express 4.0 would effectively mean rewriting the
entire application, so we thought it would be more appropriate to
create a new library.
Koa does not provides functionalities like Routing, Templating, Sending files and JSONP while the express does.
koa exposes its own ctx.request and ctx.response objects instead of node's req and res objects i.e. functions of the form (req, res, next), are incompatible with Koa.
Koa can be viewed as an abstraction of node.js's http modules, where as Express is an application framework for node.js.
For more detailed answer you can visit official documents on this link :
https://github.com/koajs/koa/blob/master/docs/koa-vs-express.md

Resources