
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
blitz-server
Advanced tools
Framework for deploying Express and WebSocket enabled servers in an OO fashion
A simple, fast wrapper for getting Express HTTP and WebSocket servers up, running, and maintained.
Express is nice and concise and that is exactly what a lot of minimalist, simple services need. But, in larger projects, there are a lot of decisions to be made about how to best used express. The goal of Blitz Server is to create both a minimalist framework on top of Express AND provide large-project level abstractions for ease of separation and interaction.
$ npm install blitz-server
var Blitz = require( 'blitz' );
// Create a root endpoint that just returns the default JSON object with data set to "Thank you!"
Blitz( "root" ).get( "/" ).then( ( req, res ) => res.ok( "Thank you!" ) );
// Run the server
Blitz.start();
var BlitzServer = require( 'blitz/server' );
var config = {};
config.port = 9001;
config.name = "Hello World";
var server = new BlitzServer( config );
server.setDefaultSecurityPolicy( function( req, done )
{
if ( req.query.id === "myadminname" )
{
// Return true to indicate that the security
// policy has been met.
done( true );
return;
}
// False indicate the security policy has NOT been met
// and will cause an unauthorized access message.
done( false );
} );
// Alternate configurations can be supplied
var devConfig = {};
devConfig.environment = "dev";
// Merged configurations will look through the arguments used to spawn
// the process and determine if they should be merged into the server's
// configuration object.
// If this server was started with the arg 'dev', then the specified config
// will be merged in, otherwise discarded.
server.mergeConfigs( { dev : devConfig } );
// Endpoints should be added individually
server.addEndpoint( require( './rootendpoint' ) );
server.start();
var BlitzEndpoint = require( '../../http/endpoint' );
// Endpoint instance that all actions will be attached to
var rootEndpoint = new BlitzEndpoint( "root" );
// Secure endpoint (using default policy)
// @NOTE: 'then' is not a thenable, just a function convention
rootEndpoint.get( "/" ).setSecure( true ).then( function( req, res, config )
{
var data = {};
data.message = "hello world";
data.config = config;
// ok function is used for an OK response (everything went OK)
res.ok( data );
} );
// Non-secure endpoint posting to the same root URL,
// note that 'id' is required as part of the query parameter
// and 'name' is required as part of the posted body.
rootEndpoint.post( "/" )
.requireParam( "id" )
.requireBodyParam( "name" )
.then( function( req, res )
{
// An error alias allows more semantic error code
res.error.internal( "NOT_IMPLEMENT" );
} );
rootEndpoint.put( "/" ).then( function( req, res )
{
// Various error types exist with reasonable error code mappings
res.error.security( "You are not admin" );
} );
// Endpoint is exported for requiring in by the entry point module (see: server above)
module.exports = rootEndpoint;
Coming soon!
Coming soon!
FAQs
Framework for deploying Express and WebSocket enabled servers in an OO fashion
We found that blitz-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.