
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
@quoin/expressjs-routes-info
Advanced tools
This small library tries to help implementing rfc6570 as route path in expressJS. It is far from implementing the whole RFC6570, but is a good starting point to be able to define basic routes this way.
It allows the user to define routes in an ExpressJS application
using routers, and enable them to reuse the routes to generate dynamic values.
The idea behind this library is to pass and construct the req.baseUrl
value
statically. This value is only available for the current router at runtime, and
reconstructing the path from the generated regexp is quite tedious.
In your server/app.js
:
const routesInfo = require('./routes');
const app = express();
app.use(routesInfo('/something', '/').router);
In your server/routes.js
:
const RoutesInfo = require('@quoin/expressjs-routes-info');
const homepageRoutesInfo = require('./homepage').routesInfo;
const mapRoutesInfo = require('./map').routesInfo;
module.exports = (subPath, baseUrl) => {
const routesInfo = new RoutesInfo(subPath, baseUrl);
const prefix = `${baseUrl}/${subPath}`;
routesInfo.use(homepageRoutesInfo('/', prefix));
routesInfo.use(mapRoutesInfo('/map', prefix));
return routesInfo;
};
In your server/map/routes.js
:
const RoutesInfo = require('@quoin/expressjs-routes-info');
const controllers = require('./controllers');
module.exports = (subPath, baseUrl) => {
const routesInfo = new RoutesInfo(subPath, baseUrl);
routesInfo.route('map', '/{id}')
.get(controllers.index);
return routesInfo;
};
or you can also use the express notation:
routesInfo.route('map', '/:id')
.get(controllers.index);
The route will also accept querystring:
// Not RFC6570
routesInfo.route('pageView', '/pageView/{domain}?pv={id}')
.get(controllers.index);
// RFC6570
routesInfo.route('pageView', '/pageView/{domain}{?pv}')
.get(controllers.index);
The difference between the two is what variable name will be used during the
.expand()
call. We would agree that the query param should have been id
,
instead of pv
, but this is to demonstrate the options.
You can alternatively pass in an implementations object: (new in 0.1.8)
The basic usage will return the expressJS route instance and all methods can
then be added as you would normally do after defining .route()
.
routesInfo.route('route-name', '/path/{param}')
.get(...)
.post(...)
Object that is defined as:
implementations = Object.freeze({
get: getImplementation,
post: postImplementation,
...
});
routesInfo.route('route-name', '/path/{param}', implementations);
and the library will extract all
and the
HTTP request methods
(beside connect
), and assign them to the route for that specific method.
options = {
allowPatch: 'application/json',
...
};
This signature is just a quick way to add the Allow-Patch
header if the
patch
implementation is defined to all methods.
With this new library, you can now generate the URL dynamically:
const RoutesInfo = require('@quoin/expressjs-routes-info');
console.log(RoutesInfo.expand('map', {id: '0xABCDEF'}));
// /something/map/0xABCDEF
When passing req
as the optional third argument, the URL should be generated
as a full URI (containing the hostname):
console.log(RoutesInfo.expand('map', {id: '0xABCDEF'}, req));
// https://your-host:port/something/map/0xABCDEF
Add a named static path to the app
. Approximatively equivalent to:
app.use(`${baseUrl}/${urlPath}`, express.static(folderPath));
Add a route to an external URL. This will not try to add a route to your application.
> RoutesInfo.externalUrl('hello:world', 'http://external.host/foo/bar/{sub}{?param1,param2}');
> RoutesInfo.expand('hello:world', { sub: 'foobar', param2:'value2' });
'http:/external.host/foo/bar/foobar?param2=value2'
This is not intended to support mailto:
, so use at your own risk.
To enable debugging message, define
DEBUG=Quoin:expressjs-routes-info:*
This should not be needed for normal operation, but was added to allow testing of code that depends on this library.
const routesInfoCache = require('@quoin/expressjs-routes-info/lib/cache');
describe("", () => {
beforeEach(() => {
routesInfoCache.reset();
});
afterEach(() => {
routesInfoCache.reset();
});
});
FAQs
ExpressJS named routes
The npm package @quoin/expressjs-routes-info receives a total of 6 weekly downloads. As such, @quoin/expressjs-routes-info popularity was classified as not popular.
We found that @quoin/expressjs-routes-info demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.