Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@growthbook/edge-utils
Advanced tools
GrowthBook is a modular Feature Flagging and Experimentation platform.
The GrowthBook Edge App provides turnkey Visual Editor and URL Redirect experimentation on edge without any of the flicker associated with front-end experiments while also supporting manual feature flagging and experimentation. It runs as a smart proxy layer between your application and your end users. It also can inject a fully-hydrated front-end SDK onto the rendered page, meaning no extra network requests needed.
[!NOTE]
This is a vendor-agnostic base app for the GrowthBook Edge App. It is used by our vendor-specific Edge Apps (Cloudflare Workers, Lambda@Edge). You can also easily build a custom implementation for your edge provider.
To run the edge app, add our base app to request handler to your project. You will need to manually build app context and helper functions:
import { edgeApp, getConfig, defaultContext } from "@growthbook/edge-utils";
export async function handler(request, env) {
const context = await init(env);
return edgeApp(context, request);
}
function init(env) {
const context = defaultContext;
context.config = getConfig(env);
context.helpers = {
// define utility functions for request/response manipulation
};
return context;
}
Add these required fields, at minimum, to your environment variables:
PROXY_TARGET="https://internal.mysite.io" # The non-edge URL to your website
GROWTHBOOK_API_HOST="https://cdn.growthbook.io"
GROWTHBOOK_CLIENT_KEY="abc123"
GROWTHBOOK_DECRYPTION_KEY="qwerty1234" # Optional
See the complete list of environment variables in the Configuration section.
Set up an edge key-val store and optionally use a GrowthBook SDK Webhook to keep feature and experiment values synced between GrowthBook and your edge worker. This eliminates network requests from your edge to GrowthBook.
The GrowthBook Edge App supports a number of configuration options available via environment variables:
PROXY_TARGET
- Non-edge url to your websiteFORWARD_PROXY_HEADERS
- "true" or "1" to preserve response headers from your server (default : true
)FOLLOW_REDIRECTS
- "true" or "1" to follow redirects when processing an origin response (default : true
)USE_DEFAULT_CONTENT_TYPE
- "true" or "1" to assume a content-type of "text-html" if no "Content-Type" header was set (default false
).PROCESS_TEXT_HTML_ONLY
- "true" or "1" to only process server responses with the Content-Type: text/html
header set – others will be proxied through (default true
).NODE_ENV
- default: production
ROUTES
- JSON encoded array of Routes, rules for intercepting, proxy passing, or erroring based on request URL pattern matchingRUN_VISUAL_EDITOR_EXPERIMENTS
- One of everywhere
, edge
, browser
, or skip
(default everywhere
)DISABLE_JS_INJECTION
- "true" or "1" to skip injecting JavaScript coming from a Visual Experiment (default false
)RUN_URL_REDIRECT_EXPERIMENTS
- One of everywhere
, edge
, browser
, or skip
(default browser
)RUN_CROSS_ORIGIN_URL_REDIRECT_EXPERIMENTS
- One of everywhere
, edge
, browser
, or skip
(default browser
)INJECT_REDIRECT_URL_SCRIPT
- "true" or "1" to mutate browser URL via window.history.replaceState() to reflect the redirected URL (default true
)MAX_REDIRECTS
- Number of on-edge redirects calculated before bailing out. Only the final redirect is fetched from your origin. (default 5
)SCRIPT_INJECTION_PATTERN
- Inject the GrowthBook SDK before this token (default </head>
)DISABLE_INJECTIONS
- "true" or "1" to disable SDK injection entirely, including tracking callbacks (default false
)GROWTHBOOK_API_HOST
- RequiredGROWTHBOOK_CLIENT_KEY
- RequiredGROWTHBOOK_DECRYPTION_KEY
- Required when using an encrypted SDK Connection
STALE_TTL
- In-memory SDK cache TTL (default 1 min = 60000
).GROWTHBOOK_TRACKING_CALLBACK
- String representation of custom JavaScript client-side tracking callback.ENABLE_STREAMING
- "true" or "1" to enable front-end SSE streaming (default false
)ENABLE_STICKY_BUCKETING
- "true" or "1" to enable Sticky Bucketing, cookie-based by default (default false
)STICKY_BUCKET_PREFIX
- The name prefix for Sticky Bucketing cookies (default gbStickyBuckets__
)PERSIST_UUID
- "true" or "1" to write the user's ID to cookie from the edge server instead of from the browser (default false
)NO_AUTO_COOKIES
- "true" or "1" to avoid writing any cookies (excluding Sticky Buckets) until user permission is granted on front-end via document.dispatchEvent(new CustomEvent("growthbookpersist"));
(default false
)UUID_COOKIE_NAME
- Customize the cookie name for persisting the user's ID (default gbuuid
)UUID_KEY
- Customize the user identifier name (default id
)SKIP_AUTO_ATTRIBUTES
"true" or "1" to skip auto-generating targeting attributes (default false
)ALWAYS_PARSE_DOM
- Normally the worker will only build a virtual DOM if there are visual changes. Set to "true" or "1" to always build a virtual DOM so that you can access it in lifecycle hooks (ex: onBodyReady
)CONTENT_SECURITY_POLICY
- CSP header valueYou can perform custom logic and optionally return a response at various stages in the Edge App's lifecycle. This allows for expressiveness of custom routing, user attribute mutation, header and body (DOM) mutation, and custom feature flag and experiment implementations – while preserving the ability to automatically run Visual and URL Redirect experiments and SDK hydration.
With each hook, you may mutate any of the provided attributes or return an early response to halt the Edge App processing. The following hooks are available
onRequest
- Fired on initial user request. Can exit early based on requested URL.onRoute
- Fired after standard routing has been processed. Can exit early (proxy) based on manual routing logic.onUserAttributes
- Fired after auto-attributes have been assigned to the user. Either enhance the provided attributes
object or exit early if desired.onGrowthBookInit
- Fired after the Edge App's internal GrowthBook SDK has been initialized. Call SDK functions or exit early if desired.onBeforeOriginFetch
- Similar hook to the above; triggers after any URL Redirect experiments have run but before any origin requests have been made.onOriginFetch
- Fired immediately after the origin fetch has been made, but before the full response body has been captured. Useful for exiting early based on response status or headers.onBodyReadyParams
- Fired once the entire response body has been parsed. In addition to early exiting, you may begin to mutate the final response body via resHeaders
and the setBody()
method. The text body
as well as the optional parsed virtual DOM root
(disabled by default, use ALWAYS_PARSE_DOM
to enable) are exposed. NOTE: If mutating the root
DOM, it is your responsibility to setBody()
with the latest changes before the response is returned.onBeforeResponse
- The final hook fired before the response is returned to the user, triggering after both visual editor changes and client SDK hydration have been injected. While the virtual DOM is no longer available, this hook can be used to apply any final changes the body via setBody()
.See the Edge App documentation for more details and examples.
FAQs
Edge worker base app
The npm package @growthbook/edge-utils receives a total of 61 weekly downloads. As such, @growthbook/edge-utils popularity was classified as not popular.
We found that @growthbook/edge-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.