
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
cometd-nodejs-server
Advanced tools
Server side APIs and implementation of the Bayeux Protocol for the NodeJS environment. WebSocket not (yet) supported.
npm install cometd-nodejs-server
npm install mocha
npm install cometd
npm install cometd-nodejs-client
npm test
var http = require('http');
var cometd = require('cometd-nodejs-server');
var cometdServer = cometd.createCometDServer();
var httpServer = http.createServer(cometdServer.handle);
httpServer.listen(0, 'localhost', function() {
// Your application code here.
});
var cometd = require('cometd-nodejs-server');
var cometdServer = cometd.createCometDServer({
logLevel: 'debug', // Emits logging on the console
timeout: 10000, // Heartbeat timeout in milliseconds
maxInterval: 15000, // Server-side session expiration in milliseconds
...
});
CometD clients send periodic heartbeat messages on the /meta/connect
channel.
The CometD server holds these heartbeat messages for at most the timeout
value
(see above), by default 30 seconds.
The NodeJS server also has a timeout
property that controls the maximum time
to handle a request/response cycle, by default 120 seconds.
You want to be sure that NodeJS' Server.timeout
is greater than CometD's
CometDServer.options.timeout
, especially if you plan to increase the CometD
timeout.
var channel = cometdServer.createServerChannel('/service/chat');
channel.addListener('message', function(session, channel, message, callback) {
// Your message handling here.
// Invoke the callback to signal that handling is complete.
callback();
});
var channel = cometdServer.createServerChannel('/chat');
channel.publish(session, message.data);
cometdServer.policy = {
canHandshake: function(session, message, callback) {
// Your handshake policy here.
var allowed = ...;
// Invoke the callback to signal the policy result.
callback(null, allowed);
}
};
var session = cometdServer.getServerSession(sessionId);
session.deliver(null, '/service/chat', {
text: 'lorem ipsum'
});
session.addListener('removed', function(session, timeout) {
if (timeout) {
// Session was expired by the server.
} else {
// Session was explicitly disconnected.
}
});
In certain cases it is necessary to access contextual information such as the HTTP request that carries incoming CometD messages, or the HTTP response that carries outgoing CometD messages.
var channel = cometdServer.createServerChannel('/chat');
channel.addListener('message', function(session, channel, message, callback) {
// Access contextual information.
var request = cometdServer.context.request;
if (request) {
// You can read headers from the NodeJS HTTP request.
var myHeader = request.headers['X-My-Header'];
...
}
var response = cometdServer.context.response;
if (response) {
// You can add headers to the NodeJS HTTP response.
response.setHeader('X-My-Header', 'foo_bar');
...
}
// Invoke the callback to signal that handling is complete.
callback();
});
NOTE: always check if the
request
andresponse
objects are defined; they may not be defined if the transport used is not HTTP but, for example, WebSocket.
FAQs
CometD server for NodeJS
The npm package cometd-nodejs-server receives a total of 99 weekly downloads. As such, cometd-nodejs-server popularity was classified as not popular.
We found that cometd-nodejs-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.