
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@hoobs/express-ws
Advanced tools
This fork uses require()
instead of ES6 imports.
You should probably use the upstream (it’s awesome; thank you, Henning).
Still here? OK, so here’s why I hacked together this fork:
If these are not concerns for you, please head on over to the upstream. If you npm install
it instead of including it from source, the issues I outlined above should not affect you.
If you do want to include this fork in your project instead of the upstream, in your package.json:
"dependencies": {
"express-ws": "github:aral/express-ws"
}
In addition to using require()
instead of ES6 imports, this fork also enables you to access the WebSocket Server instance and the Express app instance from within routes via this
:
app.ws('/chat', function(ws, req) {
ws.on('message', message => {
this.getWss('/chat').clients.forEach(client => {
client.send(message)
})
})
});
See the Chat example for a demonstration.
We now return to the regular upstream documentation…
WebSocket endpoints for Express applications. Lets you define WebSocket endpoints like any other type of route, and applies regular Express middleware. The WebSocket support is implemented with the help of the ws library.
npm install --save express-ws
Full documentation can be found in the API section below. This section only shows a brief example.
Add this line to your Express application:
var expressWs = require('express-ws')(app);
Important: Make sure to set up the express-ws
module like above before loading or defining your routers! Otherwise, express-ws
won't get a chance to set up support for Express routers, and you might run into an error along the lines of router.ws is not a function
.
After setting up express-ws
, you will be able to add WebSocket routes (almost) the same way you add other routes. The following snippet sets up a simple echo server at /echo
. The ws
parameter is an instance of the WebSocket class described here.
app.ws('/echo', function(ws, req) {
ws.on('message', function(msg) {
ws.send(msg);
});
});
It works with routers, too, this time at /ws-stuff/echo
:
var router = express.Router();
router.ws('/echo', function(ws, req) {
ws.on('message', function(msg) {
ws.send(msg);
});
});
app.use("/ws-stuff", router);
var express = require('express');
var app = express();
var expressWs = require('express-ws')(app);
app.use(function (req, res, next) {
console.log('middleware');
req.testing = 'testing';
return next();
});
app.get('/', function(req, res, next){
console.log('get route', req.testing);
res.end();
});
app.ws('/', function(ws, req) {
ws.on('message', function(msg) {
console.log(msg);
});
console.log('socket', req.testing);
});
app.listen(3000);
Sets up express-ws
on the specified app
. This will modify the global Router prototype for Express as well - see the leaveRouterUntouched
option for more information on disabling this.
express-ws
on.http.Server
, you should pass it in here, so that express-ws
can use it to set up the WebSocket upgrade handlers. If you don't specify a server
, you will only be able to use it with the server that is created automatically when you call app.listen
.true
to keep express-ws
from modifying the Router prototype. You will have to manually applyTo
every Router that you wish to make .ws
available on, when this is enabled.This function will return a new express-ws
API object, which will be referred to as wsInstance
in the rest of the documentation.
This property contains the app
that express-ws
was set up on.
Returns the underlying WebSocket server/handler. You can use wsInstance.getWss().clients
to obtain a list of all the connected WebSocket clients for this server.
Note that this list will include all clients, not just those for a specific route - this means that it's often not a good idea to use this for broadcasts, for example.
To get just the clients for a given route, please specify the route using the optional route
parameter.
Sets up express-ws
on the given router
(or other Router-like object). You will only need this in two scenarios:
options.leaveRouterUntouched
, orIn most cases, you won't need this at all.
Routes are bound to the wsInstance so you can access .getWss()
and .app
via this
in your routes even if the original wsInstance is not in scope (e.g., if you have your routes defined in external files).
This module is written in ES6 and uses ESM.
FAQs
WebSocket endpoints for Express applications (require version)
We found that @hoobs/express-ws demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.