Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@40seas-public/serverless-express
Advanced tools
This library enables you to utilize AWS Lambda and Amazon API Gateway to respond to web and API requests using your existing Node.js application framework.
Run REST APIs and other web applications using your existing Node.js application framework (Express, Koa, Hapi, Sails, etc.), on top of AWS Lambda and Amazon API Gateway or Azure Function.
npm install @vendia/serverless-express
Want to get up and running quickly? Check out our basic starter example that includes:
If you want to migrate an existing application to AWS Lambda, it's advised to get the minimal example up and running first, and then copy your application source in.
The only AWS Lambda specific code you need to write is a simple handler like below. All other code you can write as you normally do.
// lambda.js
const serverlessExpress = require('@vendia/serverless-express')
const app = require('./app')
exports.handler = serverlessExpress({ app })
If your application needs to perform some common bootstrap tasks such as connecting to a database before the request is forward to the API, you can use the following pattern (also available in this example):
// lambda.js
require('source-map-support/register')
const serverlessExpress = require('@vendia/serverless-express')
const app = require('./app')
let serverlessExpressInstance
function asyncTask () {
return new Promise((resolve) => {
setTimeout(() => resolve('connected to database'), 1000)
})
}
async function setup (event, context) {
const asyncValue = await asyncTask()
console.log(asyncValue)
serverlessExpressInstance = serverlessExpress({ app })
return serverlessExpressInstance(event, context)
}
function handler (event, context) {
if (serverlessExpressInstance) return serverlessExpressInstance(event, context)
return setup(event, context)
}
exports.handler = handler
The only Azure Function specific code you need to write is a simple index.js
and a function.json
like below.
// index.js
const serverlessExpress = require('@vendia/serverless-express')
const app = require('./app')
const cachedServerlessExpress = serverlessExpress({ app })
module.exports = async function (context, req) {
return cachedServerlessExpress(context, req)
}
The out-binding parameter "name": "$return"
is important for Serverless Express to work.
// function.json
{
"bindings": [
{
"authLevel": "anonymous",
"type": "httpTrigger",
"direction": "in",
"name": "req",
"route": "{*segments}"
},
{
"type": "http",
"direction": "out",
"name": "$return"
}
]
}
resolutionMode
to use "CONTEXT"
or "CALLBACK"
isBase64Encoded
without specifying binaryMimeTypes
. Use binarySettings
to customize. Thanks to @dougmoscrop from https://github.com/dougmoscrop/serverless-httprespondWithErrors
makes it easier to debug during developmentSee UPGRADE.md to upgrade from aws-serverless-express and @vendia/serverless-express 3.x
Determine if the response should be base64 encoded before being returned to the event source, for example, when returning images or compressed files. This is necessary due to API Gateway and other event sources not being capable of handling binary responses directly. The event source is then responsible for turning this back into a binary format before being returned to the client.
By default, this is determined based on the content-encoding
and content-type
headers returned by your application. If you need additional control over this, you can specify binarySettings
.
{
binarySettings: {
isBinary: ({ headers }) => true,
contentTypes: ['image/*'],
contentEncodings: []
}
}
Any value you provide here should also be specified on API Gateway API. In SAM, this looks like:
ExpressApi:
Type: AWS::Serverless::Api
Properties:
StageName: prod
BinaryMediaTypes: ['image/*']
'PROMISE'
)Lambda supports three methods to end the execution and return a result: context, callback, and promise. By default, serverless-express uses promise resolution, but you can specify 'CONTEXT' or 'CALLBACK' if you need to change this. If you specify 'CALLBACK', then context.callbackWaitsForEmptyEventLoop = false
is also set for you.
serverlessExpress({
app,
resolutionMode: 'CALLBACK'
})
process.env.NODE_ENV === 'development'
)Set this to true to have serverless-express include the error stack trace in the event of an unhandled exception. This is especially useful during development. By default, this is enabled when NODE_ENV === 'development'
so that the stack trace isn't returned in production.
serverless-express natively supports API Gateway, ALB, and Lambda@Edge. If you want to use Express with other AWS Services integrated with Lambda you can provide your own custom request/response mappings via eventSource
. See the custom-mapper-dynamodb example.
function requestMapper ({ event }) {
// Your logic here...
return {
method,
path,
headers
}
}
function responseMapper ({
statusCode,
body,
headers,
isBase64Encoded
}) {
// Your logic here...
return {
statusCode,
body,
headers,
isBase64Encoded
}
}
serverlessExpress({
app,
eventSource: {
getRequest: requestMapper,
getResponse: responseMapper
}
})
A single function can be configured to handle additional kinds of AWS events:
Assuming the following function configuration in serverless.yml
:
functions:
lambda-handler:
handler: src/lambda.handler
events:
- http:
path: /
method: get
- sns:
topicName: my-topic
- stream:
type: dynamodb
arn: arn:aws:dynamodb:us-east-1:012345678990:table/my-table/stream/2021-07-15T15:05:51.683
- sqs:
arn: arn:aws:sqs:us-east-1:012345678990:myQueue
- eventBridge:
pattern:
source:
- aws.cloudformation
And the following configuration:
serverlessExpress({
app,
eventSourceRoutes: {
'AWS_SNS': '/sns',
'AWS_DYNAMODB': '/dynamodb',
'AWS_SQS': '/sqs'
'AWS_EVENTBRIDGE': '/eventbridge',
'AWS_KINESIS_DATA_STREAM': '/kinesis',
}
})
Alternatively, to handle only SNS events (the keys in the map are optional)
serverlessExpress({
app,
eventSourceRoutes: {
'AWS_SNS': '/sns',
}
})
Events will POST
to the routes configured.
Also, to ensure the events propagated from an internal event and not externally, it is highly recommended to
ensure the Host
header matches:
sns.amazonaws.com
dynamodb.amazonaws.com
sqs.amazonaws.com
events.amazonaws.com
kinesis.amazonaws.com
Specify log settings that are passed to the default logger. Currently, you can only set the log level
.
{
logSettings: {
level: 'debug' // default: 'error'
}
}
Provide a custom log
object with info
, debug
and error
methods. For example, you could override the default with a Winston log instance.
{
log: {
info (message, additional) {
console.info(message, additional)
},
debug (message, additional) {
console.debug(message, additional)
},
error (message, additional) {
console.error(message, additional)
}
}
}
This package exposes a function to easily get the event
and context
objects Lambda receives from the event source.
const { getCurrentInvoke } = require('@vendia/serverless-express')
app.get('/', (req, res) => {
const { event, context } = getCurrentInvoke()
res.json(event)
})
npx loadtest --rps 100 -k -n 1500 -c 50 https://xxxx.execute-api.us-east-1.amazonaws.com/prod/users
On 11/30, the AWS Serverless Express library moved from AWS to Vendia and will be rebranded to @vendia/serverless-express
. Similarly, the aws-serverless-express
NPM package will be deprecated in favor of @vendia/serverless-express.
Brett, the original creator of the Serverless Express library, will continue maintaining the repository and give it the attention and care it deserves. At the same time, we will be looking for additional contributors to participate in the development and stewardship of the Serverless Express library. AWS and the SAM team will remain involved in an administrative role alongside Vendia, Brett, and the new maintainers that will join the project.
We believe this is the best course of action to ensure that customers using this library get the best possible support in the future. To learn more about this move or become a maintainer of the new Serverless Express library, reach out to us through a GitHub issue on this repository.
Best, The AWS Serverless team, Brett & the Vendia team
FAQs
This library enables you to utilize AWS Lambda and Amazon API Gateway to respond to web and API requests using your existing Node.js application framework.
We found that @40seas-public/serverless-express demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.