Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
#node-apn
A Node.js module for interfacing with the Apple Push Notification service.
Via npm:
$ npm install apn
As a submodule of your project (you will also need to install q)
$ git submodule add http://github.com/argon/node-apn.git apn
$ git submodule update --init
var apns = require('apn');
Create a new connection to the gateway server using a dictionary of options. The defaults are listed below:
var options = {
cert: 'cert.pem', /* Certificate file path */
certData: null, /* String or Buffer containing certificate data, if supplied uses this instead of cert file path */
key: 'key.pem', /* Key file path */
keyData: null, /* String or Buffer containing key data, as certData */
passphrase: null, /* A passphrase for the Key file */
ca: null /* String or Buffer of CA data to use for the TLS connection */
gateway: 'gateway.push.apple.com',/* gateway address */
port: 2195, /* gateway port */
enhanced: true, /* enable enhanced format */
errorCallback: undefined, /* Callback when error occurs function(err,notification) */
cacheLength: 100 /* Number of notifications to cache for error purposes */
};
var apnsConnection = new apns.Connection(options);
Important: In a development environment you must set gateway
to gateway.sandbox.push.apple.com
.
To send a notification first create a Device
object. Pass it the device token as either a hexadecimal string, or alternatively as a Buffer
object containing the token in binary form.
var myDevice = new apns.Device(token);
Next, create a notification object and set parameters. See the payload documentation for more details.
var note = new apns.Notification();
note.expiry = 60;
note.badge = 3;
note.sound = "ping.aiff";
note.alert = "You have a new message";
note.payload = {'messageFrom': 'Caroline'};
note.device = myDevice;
apnsConnection.sendNotification(note);
As of version 1.2.0 it is also possible to use a set of methods provided by Notification object (setAlertText
, setActionLocKey
, setLocKey
, setLocArgs
, setLaunchImage
) to aid the creation of the alert parameters. For applications which provide Newsstand capability there is a new boolean parameter note.newsstandAvailable
to specify content-available
in the payload.
The above options will compile the following dictionary to send to the device:
{"messageFrom":"Caroline","aps":{"badge":3,"sound":"ping.aiff","alert":"You have a new message"}}
*N.B.: If you wish to send notifications containing emoji or other multi-byte characters you will need to set note.encoding = 'ucs2'
. This tells node to send the message with 16bit characters, however it also means your message payload will be limited to 127 characters.
If the enhanced binary interface is enabled and an error occurs - as defined in Apple's documentation - when sending a message, then subsequent messages will be automatically resent* and the connection will be re-established. If an errorCallback
is also specified in the connection options then it will be invoked with 2 arguments (err, notification)
If a notification fails to be sent because a connection error occurs then the errorCallback
will be called for each notification waiting for the connection which failed. In this case the first parameter will be an Error object instead of an error number.
errorCallback
will be called in 3 situations with the parameters shown.
errorCallback(errorCode, notification)
cacheLength
value to prevent data loss errorCallback(255, null)
errorCallback(Error object, notification)
*N.B.: The cacheLength
option for the connection specifies the number of sent notifications which will be cached, on a FIFO basis for error handling purposes. If cacheLength
is not set to a large enough value, then in high volume environments, a notification - possibly including some subsequent notifications - may be removed from the cache before Apple returns an error associated with it. In this case the errorCallback
will still be called, but with a null
notification and error code 255. If this happens you should consider increasing cacheLength
to prevent losing notifications. All the notifications still residing in the cache will be resent automatically.
Apple recommends checking the feedback service periodically for a list of devices for which there were failed delivery attempts.
Using the Feedback
object it is possible to periodically query the server for the list. You should provide a function feedback
which will accept two arguments, the time
returned by the server (epoch time) and a Buffer
object containing the device token. You can also set the query interval in seconds. The default options are shown below.
var options = {
cert: 'cert.pem', /* Certificate file */
certData: null, /* Certificate file contents (String|Buffer) */
key: 'key.pem', /* Key file */
keyData: null, /* Key file contents (String|Buffer) */
passphrase: null, /* A passphrase for the Key file */
ca: null, /* Certificate authority data to pass to the TLS connection */
address: 'feedback.push.apple.com', /* feedback address */
port: 2196, /* feedback port */
feedback: false, /* enable feedback service, set to callback */
interval: 3600 /* interval in seconds to connect to feedback service */
};
var feedback = new apns.Feedback(options);
This will automatically start a timer to check with Apple every interval
seconds. You can cancel the interval by calling feedback.cancel()
. If you do not wish to have the service automatically queried then set interval
to 0 and use feedback.start()
.
Important: In a development environment you must set address
to feedback.sandbox.push.apple.com
.
More information about the feedback service can be found in the feedback service documentation.
After requesting the certificate from Apple, export your private key as a .p12 file and download the .cer file from the iOS Provisioning Portal.
Now, in the directory containing cert.cer and key.p12 execute the following commands to generate your .pem files:
$ openssl x509 -in cert.cer -inform DER -outform PEM -out cert.pem
$ openssl pkcs12 -in key.p12 -out key.pem -nodes
If you are using a development certificate you may wish to name them differently to enable fast switching between development and production. The filenames are configurable within the module options, so feel free to name them something more appropriate.
Written and maintained by Andrew Naylor.
Contributors: Ian Babrou, dgthistle, Keith Larsen, Mike P
Released under the MIT License
Copyright (c) 2010 Andrew Naylor
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
1.2.0:
errorCallback
will also be invoked for connection errors.Notification
to aid settings the alert properties.content-available
can now be set for Newsstand applications by setting the newsstandAvailable
property on the Notification object.Notification
objects now have a .clone(device)
method to assist you in sending the same notification to multiple devices..toString()
method to return the hex representation of the device token.1.1.7:
1.1.6:
1.1.5:
certData
and keyData
options)1.1.4:
1.1.3:
1.1.2:
1.1.1:
1.1.0:
1.0.4:
1.0.3:
1.0.2:
1.0.1:
index.js
to make module loading tidier1.0.0:
FAQs
An interface to the Apple Push Notification service for Node.js
The npm package apn receives a total of 45,583 weekly downloads. As such, apn popularity was classified as popular.
We found that apn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.