Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
byu-circuitbreaker
Advanced tools
An NPM package that facilitates implementation of a circuit breaker, intended as a responder in a Scatter-Gather pattern. This module provides a framework for implementing:
It's built to be able to take advantage of AWS ElastiCache as a way to share a state between load-balanced server instances.
npm install byu-circuitbreaker
This module is quite flexible.
Be sure to require it like:
var CircuitBreaker = require('byu-circuitbreaker');
Then, you pass in configuration similar to this when you make a new circuit breaker:
var missionary_config = {
"sns_alert_arn": "arn:aws:sns:us-west-2:026968893061:missionary_alerts",
"use_elasticache": true,
"elasticache_endpoint": "missionarycbcluster.u5wkfp.0001.usw2.cache.amazonaws.com",
"elasticache_port": 6379,
"seconds_before_allowing_retry": 15,
"seconds_to_block_api": 300,
"populateLinks": require("./populateLinks"),
"prepareRequestOptions": require('./preparationFunction'),
"backoff_options": {
initial_delay: 1000,
max_delay: 5000,
num_retries_allowed: 5
},
"validationFunction": require('./validateMissions'),
"formatValues": require('./formatValues')
};
var missionary_cb = new CircuitBreaker(missionary_config);
Or as some examples of simpler configurations:
var simple_config_w_values_array = {
"prepareRequestOptions": function(byu_id, verifiedJWTs) {
return {
"url": "http://www.theapitocall.com"+byu_id
};
},
"populateLinks": function(byu_id) {
return {
"missions__info": {
"rel": "self",
"href": "https://api.byu.edu/cesapi/applicants/"+byu_id+"/missions",
"method": "GET",
"title": "missions.getMissions"
}
};
},
//Note: The metadata field will be determined automatically based on the size of this array:
"formatValues": function(full_api_response, byu_id, verifiedJWTs) {
var values = [];
var value = {
"applicant_id": {
"value": byu_id,
"api_type": "system",
"key": true,
"display_label": "BYU ID"
},
"mission_service": {
"value": "Y",
"api_type": "read-only",
"display_label": "Have you served or are you currently serving a mission?"
},
"mission_name": {
"value": full_api_response.body.mission_name,
"domain": "https://api.byu.edu/byuapi/meta/mission_names",
"api_type": "read-only",
"display_label": "Mission Name"
}
};
values.push(value);
return values;
}
};
var simple_cb = new CircuitBreaker(simple_config_w_values_array);
var simple_config_without_array = {
"wellknown_url": "https://api.byu.edu/.well-known/openid-configuration", //Used for checking JWTs
"prepareRequestOptions": function(byu_id, verifiedJWTs) {
return {
"url": "http://www.theapitocall.com"+byu_id
};
},
"populateLinks": function(byu_id) {
return {
"missions__info": {
"rel": "self",
"href": "https://api.byu.edu/cesapi/applicants/"+byu_id+"/missions",
"method": "GET",
"title": "missions.getMissions"
}
};
},
"formatValues": function(full_api_response, byu_id, verifiedJWTs) {
return {
"applicant_id": {
"value": byu_id,
"api_type": "system",
"key": true,
"display_label": "Applicant ID"
},
"mission_service": {
"value": "Y",
"api_type": "read-only",
"display_label": "Have you served or are you currently serving a mission?"
},
"mission_name": {
"value": full_api_response.body.mission_name,
"domain": "https://api.byu.edu/byuapi/meta/mission_names",
"api_type": "read-only",
"display_label": "Mission Name"
}
};
}
};
var simple_cb = new CircuitBreaker(simple_config_without_array);
and finally, you use it like this:
missionary_cb.processRequest(byu_id, verifiedJWTs)
.then(function(output) {
//Do something with output
});
false
.use_elasticache = true
) The endpoint of an AWS ElastiCache cluster using Redis.use_elasticache = true
) The port for the AWS ElastiCache cluster using Redis.-1
will disable this feature, and using 0
will permanently block retries.
Defaults to 15
seconds.-1
will disable this feature, and using 0
will permanently block retries.
Defaults to 300
seconds.function(byu_id) {
//Return an object that matches the "links" field of our API specifications
return {};
}
function(byu_id, verifiedJWTs) {
//Return an object that defines the options when making an API request.
return {
"url": "http://www.theapitocall.com/"+byu_id
};
}
If using an asynchronous function, this should return a promise instead.
For the format of the object, see the "options"
object at https://www.npmjs.com/package/request-promise.
Some common parameters include method
, url
, headers
, and body
.
It's recommended to require customErrors
and throw a PreparationFunctionError
if something goes wrong.
To properly process responses, we will always use the parameters:
{ simple: false, resolveWithFullResponse: true }
With those parameters, request-promise behaves almost identically to the regular request package.2000
ms.10000
ms.5
.function(full_api_response) {
//Return if what API gives us is expected, or throw an error if unexpected response
}
Note that this should receive the response, even if statusCode != 200
(unless API threw an error).
It's recommended to require customErrors
and throw an APIError
so that circuit breaker can block the API if it's giving invalid info.
Defaults to say every response is valid.function(full_api_response, byu_id, verifiedJWTs) {
//Should return either an object or an array
//The object will be merged with our response, the array will be placed in a "values" field in our response
return [];
}
It's recommended to require customErrors
and throw a NotFoundError
if API gave us no useful info, which will correspond to a 404.###Some Notes about ElastiCache
Elasticache is only accessible from an EC2 instance (whether you start that instance directly, or through Elastic Beanstalk).
So, if you're developing locally, you will need to make sure you haven't set use_elasticache = true
.
We use Redis-based ElastiCache Clusters. When setting them up, be sure they are in the same VPC as your EC2 instance(s) and that the security group has the appropriate inbound rule to allow access to ElastiCache. For further reference, see Amazon's documentation.
###Example
For an example of this in use, see /example/missionary_cb.js
.
FAQs
A circuit breaker for BYU admissions
We found that byu-circuitbreaker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.