
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@poppinss/request
Advanced tools
Wrapper over Node.js req object to standardize and ease the process of reading data from HTTP requests.
referer
and referrer
.ip address
of proxied requests.x-request-id
to each request.Install the package from npm as follows:
npm i @poppinss/request
# yarn
yarn add @poppinss/request
and then use it as follows
import { Request, RequestConfigContract } from '@poppinss/request'
import { createServer } from 'http'
const config: RequestConfigContract = {
allowMethodSpoofing: false,
subdomainOffset: 2,
trustProxy: require('proxy-addr').compile('loopback'),
}
createServer((req, res) => {
const request = new Request(req, res, config)
res.end(`${request.id()} ${request.url()}`)
})
{ | |
"allowMethodSpoofing": false |
Since, standard HTML forms doesn't allow all HTTP verbs like
When |
"subdomainOffset": 2 |
Offset indicates the number of values to remove from the end of the URL seperated by
For example: For URL |
"trustProxy" |
A method that allows you to selectively trust the proxy servers. Make sure to read proxy-addr docs. |
"getIp" |
Optionally define a method to determine the user Ip adress. The method is helpful, when you want to rely on a different property to find the user ip address.
For example: Nginx set
|
"secret" |
Optional Define a secret to unsign and read cookies. Make sure you have used the same secret to sign the cookie via @poppinss/response package. |
} |
The module is written in Typescript and exports following classes, types and interfaces.
import { Request, RequestContract, RequestConfigContract} from '@poppinss/request'
RequestContract is the interface that Request
class adheres too. Since, you cannot extend concrete implementations in Typescript, you may need the interface to have a lossely typed flow.
Request.macro('cartValue', function () {
return Number(this.cookie('cart')) || 0
})
then, you need to add cartValue
to the interface
import { RequestContract as BaseContract } from '@poppinss/request'
interface RequestContract extends BaseContract {
cartValue (): number
}
const request = new Request(req, res, config) as unknown as RequestContract
Following are the autogenerated files via Typedoc
FAQs
Node.js http request wrapper used by AdonisJs
We found that @poppinss/request demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.