-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathapp.js
More file actions
105 lines (82 loc) · 3.44 KB
/
Copy pathapp.js
File metadata and controls
105 lines (82 loc) · 3.44 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
const crypto = require('crypto')
const path = require('path')
const express = require('express')
const livereload = require('livereload') // for reload browser
const connectLivereload = require('connect-livereload') // for reload browser
const session = require('express-session')
const hpp = require('hpp') // Remove Duplicate Query keys
const helmet = require('helmet') // Add some Common Security Headers
const rateLimit = require('express-rate-limit') // Set request limit per IP
const errorController = require('./controllers/errorController')
const pageRouter = require('./routes/pageRoutes')
const docRouter = require('./routes/docRoutes')
const tweetRouter = require('./routes/tweetRoute')
const userRouter = require('./routes/userRoutes')
const reviewRouter = require('./routes/reviewRoutes')
const fileRouter = require('./routes/fileRoutes')
const chatRouter = require('./routes/chatRoutes')
const messageRouter = require('./routes/messageRoutes')
const notificationRouter = require('./routes/notificationRoutes')
const publicDirectory = path.join(process.cwd(), 'public')
const app = express()
app.set('query parser', 'simple') // Disable req.query auto object parse for ?color[red]
app.set('view engine', 'pug') // Setup pug as Templete
app.use((req, res, next) => {
res.locals.cspNonce = crypto.randomBytes(16).toString('hex')
next()
})
// -----[ For LiveReload ]-----
// Used for development purpose: To reload browser on file changes
if(process.env.NODE_ENV === 'development') {
const livereloadServer = livereload.createServer() // for reload browser
livereloadServer.watch(publicDirectory)
livereloadServer.server.once('connection', () => {
setTimeout(() => livereloadServer.refresh('/') , 10);
})
app.use(connectLivereload()) // for reload browser
}
// -----[ Security ]-----
// Block all inline script-src to protect from XSS attack
if(process.env.NODE_ENV !== 'development') {
app.use(helmet({
contentSecurityPolicy: {
directives: {
scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`]
}
}
})) // => Set request limit per hour for particular IP address
}
app.use(hpp()) // => _page=1&_page=3 => { _page: 3 }, instead of { _page: [1,3] }
app.use(rateLimit({ // =>
windowMs: 10 * 60 * 1000, // 10 minutes
max: 10000 // 100 requests per IP
}))
// -----[ middlewares ]-----
app.use(express.json({ limit: '10mb' })) // To capture json data by: req.body
app.use(express.urlencoded({ extended: false })) // To capture key=value data send by html form by: req.body
app.use(express.static(publicDirectory))
// Use after express.static() middleware and before templete engine
app.use(session({
secret: process.env.SESSION_SECRET,
resave: true,
saveUninitialized: false,
cookie: {
httpOnly: true,
// secure: process.env.NODE_ENV === 'production', // true === https not http
sameSite: 'strict',
maxAge: 1000*60*60*24*30 // One month
}
}))
// -----[ routes ]-----
app.use('/docs', docRouter)
app.use('/', pageRouter)
app.use('/api/tweets', tweetRouter)
app.use('/api/users', userRouter)
app.use('/api/reviews', reviewRouter)
app.use('/api/chats', chatRouter)
app.use('/api/messages', messageRouter)
app.use('/api/notifications', notificationRouter)
app.use('/upload', fileRouter)
app.all('*', errorController.pageNotFound)
app.use(errorController.errorHandler)
module.exports = app