
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@serverless-seoul/corgi
Advanced tools
Restful HTTP Framework for AWS Lambda - AWS API Gateway Proxy Integration
Grape like lightweight HTTP API Framework for AWS Lambda
This is hard fork of vingle-corgi for stable maintenance purpose
import { Namespace, Router, ValidationError } from "@serverless-seoul/corgi";
import { Type } from "@sinclair/typebox";
const router = new Router([
new Namespace('/api/:userId', {
params: {
userId: Type.Number(),
},
async before() {
const { userId } = this.params; // type of `userId` will be `number` (inferred using parameter definition!)
this.params.user = await User.findByUserId(this.params.userId);
if (!this.params.user) {
return this.json({
error: "User not exists!",
}, 404);
// You can also just throw error - which goes to exceptionHandler
}
},
async exceptionHandler(error) {
// Global Exception Handling.
if (error instanceof ValidationError) {
return this.json(
{
errors: error.details.map(e => e.message),
},
422
);
}
},
children: [
Route.GET('/followers', {}, 'List of users that following me', async function() {
return this.json({
data: {}
})
}),
new Namespace('/followings', {
children: [
Route.POST('/', '', {}, async function() {
const user = this.params.user as User;
return this.json({ userId: user.id });
}),
Route.DELETE('/', '', {}, async function() {
const user = this.params.user as User;
return this.json({ userId: user.id });
}),
]
})
]
})
]);
// this goes directly into lambda.
export const handler = router.handler();
Or refer src/test/e2e/complex_api.ts
So simple lambda handler looks like this
exports.myHandler = function(event, context, callback) {
console.log("value1 = " + event.key1);
console.log("value2 = " + event.key2);
callback(null, "some success message");
}
let's say you connected API Gateway, (using serverless maybe), as Lambda Proxy. and built some Restful API with that.
exports.myHandler = function(event, context, callback) {
if (
event.path === '/api/someapi'
&& event.method == 'GET'
) {
callback(
null, {
statusCode: 200,
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({
data: {
response: "XXX"
}
})
}
)
} else {
callback(
null, {
statusCode: 404,
headers: {
'Content-Type': 'application/json',
},
body: JSON.stringify({
error: 'Not Found',
})
}
)
}
}
Ok, fairly good, since it's on lambda and APIGateway so everything is managed and scaled....etc.
but also you can clearly see that this is at the tipping point of going unmanageable.
there are several frameworks that built for this,
(such as running express itself on lambda, even though which is what exactly AWS APIGateway is for)
lambda-req
aws-serverless-express
serverless-express
At Vingle, we did consider about using these kinds of express wrapping.
But those are really inefficient and not reliable for production usage,
and, most of all, We really thought we can do better.
Inspired by Grape a lot, since we really liked it
From v2.0, it only supports lambda nodejs8.10. if you need 6.10 support, either use v1.x or wrap router.handler
FAQs
Restful HTTP Framework for AWS Lambda - AWS API Gateway Proxy Integration
The npm package @serverless-seoul/corgi receives a total of 1 weekly downloads. As such, @serverless-seoul/corgi popularity was classified as not popular.
We found that @serverless-seoul/corgi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.