qw3r / boar-server

Boar Server

Example usage for app

put these lines in your server.js

  var koa = require('koa');
  var path = require('path');
  var koaApp = module.exports = koa();
  var config = require('./config');
  var App = require('js-stack').app;

  var app = new App(koaApp);
  app.connectToMongoose(config.mongooseUri);
  app.addDynamicViewMiddleware(path.join(config.root, '/views'), config.env === 'development');
  app.addStaticContentMiddleware(path.join(config.root, '/assets'));
  app.addHookMiddleware();
  app.loadControllers(path.join(config.root, 'controllers'));
  app.loadModels(path.join(config.root, 'models'));

  if (!module.parent) { app.listen(config.port); }

Add middleware for your app

  var cors = require('koa-cors');
  var app = new App(koaApp);
  app.addMiddleware(cors());

Lib

Mask email address

  var masEmailAddress = require('js-stack').lib.maskEmailAddress;
  masEmailAddress('[e-mail]');
  

Real ip address (in heroku)

  var realIpAddress = require('js-stack').lib.realIpAddress;
  realIpAddress(request);

ControllerFactory

  var ControllerFactory = require('js-stack.lib.controllerFactory');

  module.exports = ControllerFactory.create(function(router) {
    router.get('/', ControllerFactory.load('main/actions/get'));
    router.get('/healthcheck', ControllerFactory.load('main/actions/healthcheck/get'));
    router.get('/list', ControllerFactory.loadByAcceptType('main/actions/list/get'));
  });

SecurityMiddlewareFactory

Provides middlewares for setting up various security related HTTP headers.

  var app = new App(koaApp);

  app.addSecurityMiddlewares();

Configuration

Sample configuration with default values:

  var app = new App(koaApp);

  app.addSecurityMiddlewares({
    csp: {
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'"],
        styleSrc: ["'self'"],
        imgSrc: ["'self'"],
        frameAncestors: ["'self'"],
        reportUri: 'about:blank'
      },
      reportOnly: true
    },
    hsts: {
      maxAge: 30,
      includeSubdomains: true,
      preload: false
    },
    useXssFilter: true,
    useNoSniff: true
  });

Middlewares

1. csp: See helmetjs CSP middleware, CSP quick reference
2. hsts: See helmetjs HSTS middleware, OWASP HSTS page
3. xss: See helmetjs X-XSS-Protection middleware
4. noSniff: See helmetjs "Don't infer the MIME type" middleware

HTTPS support

To enable HTTPS support, simple create SERVE_HTTPS environment variable with value true. The port for https will be the port of the application increased with 10000 (10k).

If you want to serve the requests with your own SSL certification, create HTTPS_KEY and HTTPS_CERT environment variables with path of the files as values.

Example

export SERVE_HTTPS=true
export HTTPS_KEY="path/to/cert.key"
export HTTPS_CERT="path/to/cert.crt"

node server.js

Enforce HTTPS

Add the koa-ssl middlware:

  var app = new App(koaApp);
  app.addEnforceSSLMiddleware();

If your application is running behind reverse proxy you should set the trustProxy configiration option for detecting the x-forwarded-proto header.

  var app = new App(koaApp);
  app.addEnforceSSLMiddleware({ trustProxy: true });

If you use this middleware this middleware should be the first you add.