
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
express-git
Advanced tools
Express middleware that acts as a git-http-backend
Usage:
var express = require("express");
var expressGit = require("express-git");
var app = express();
app.use("/git", expressGit.serve("path/torepos/", {
auto_init: true,
serve_static: true,
authorize: function (service, req, next) {
// Authorize a service
next();
}
});
app.on('post-receive', function (repo, changes) {
// Do something after a push
next();
});
app.listen(3000);
After which you can
git clone http://localhost:3000/git/foo.git
cd foo
echo "# Hello Git" > README.md
git add README.md
git commit -m "Initial commit"
git push
Which will create an empty repo at path/torepos/foo.git to which you can
pull and push as usual.
default: true
Enable the git_http_backend service.
If set to false push/pull operations will not be possible over http.
default: true
Enable the raw service.
default: true
Enable the browse service.
default: true
Enable the commit service.
default: true
Enable the refs service.
default: noop
A (service, req, callback) hook to use to authorize requests.
To prevent an action, pass an error to the callback.
default:
/.*/
All repo names must match this pattern.
Any captured groups will be passed on to a req.git.repo.args object
for use in options.auth.
default: true
Allow repos to be created on-demand.
If set to false only already existing repos will be used.
default: {}
Default init_options for new repos. See Init options
To override per-repo init_options use hooks['pre-init'].
default: A year in seconds
The max_age Cache-Control header to use for served blobs
default: 2K
The max size of truncated blob data to include in browse requests.
default:
shelljs.which('git')
For git_http_backend service to work you need git installed on the server.
You can specify the git executable to use with the git_executable option.
Git hooks are implemented using events. Async event handlers are supported via Promises. Event cancellation is possible (for cancellable events) by rejecting a promise or throwing an error.
Register event listeners via expressGit.on(hook, handler)
Events to listen for:
pre-init: (name, params, init_options)Cancellable: yes
Where name is the name of the repo to be created and params is a parameter
array parsed via options.pattern. The 3rd argument init_options
is an object that you can modify to change the initialization options for this repo.
You can return a promise if you need to perform an async operation.
Rejecting will prevent the initialization of the repo.
See Git Hooks for more info.
post-init: (repo, )Cancellable: no
Where repo is a nodegit.Repository object for the new repo.
pre-receive: (repo, changes)Cancellable: yes
Where changes is an Array of {before, after, ref} objects.
Rejecting will prevent the push request.
update: (repo, change)Cancellable: yes
Where change is a {before, after, ref} object.
Rejecting will prevent the push for this specific ref.
post-receive: (repo, changes)Cancellable: no
Where changes is an Array of {before, after, ref} objects.
Rejecting will be report the error to the client but will not prevent the request.
pre-commit: (repo, commit)Cancellable: yes
Where repo is the nodegit.Repository instance where the commit will happen,
commit is an object with ref, message, author, tree, parents, committer keys.
Rejecting will abort the commit.
post-commit: (repo, changes)Cancellable: no
Where repo is the nodegit.Repository instance where the commit happened
and commit is an object with commit details.
git_http_backend serviceAllow push/pull over http at
GET /path/to/repo.git/info/refs?service=(git-receive-pack|git-upload-pack)
POST /path/to/repo.git/(git-receive-pack|git-upload-pack)
raw serviceServe blobs from any ref at
GET /path/to/repo.git/(ref?)/raw/path/to/file.txt
The default ref is HEAD.
The blob's id is added as an Etag header tho the response. The must-revalidate
Cache-Control property is also added, because the ref of the blob-serving url
might point to a different blob after a repository modification. Thus the proxy
must revalidate the freshness on each request.
See HTTP Cache Headers for more info.
browse serviceBrowse repositories as json
GET /path/to/repo.git/(ref?)/blob/(path/to/file.txt)
GET /path/to/repo.git/(ref?)/tree/(path/to/dir)?
GET /path/to/repo.git/(ref?)/commit/
GET /path/to/repo.git/(ref?)/object/(object-id)
The default ref is HEAD.
commit serviceGit commits using multipart forms
POST /path/to/repo.git/(ref?)/commit/(path/to/basepath)?parent=(object-id)
Commit parent id should either be specified by an
x-parent-idheader or theparentquery parameter. It will default to the empty object id (40 zeros)
If the provided parent id is not the current target of the ref,
the commit will be rejected with a 409 Confict error response.
name <email> format)name <email> format), fallback to authorAll form file fields will be added, using the fieldname as path.
(basepath url parameter will be prepended to this path)
refs serviceGit ref manipulation via REST
PUT /path/to/repo.git/(ref)
DELETE /path/to/repo.git/(ref)
default: true
default: true
Create the dir for the repository if does not exist
default: true
Create the all required dirs for the repository path
default: null
Permission mask to apply to the repository dir (git init --shared)
default: 'master'
The branch to which HEAD will point.
default: null
A default origin remote to use for this remote. Usually not needed as the repo will probably act as origin for others.
default: null
A GIT_TEMPLATE_PATH to use for the repo.
req.git objectEach request handled by express-git is assigned a frozen object git property with
the following properties:
req.git.hookA (name, args...) function trigerring hooks
req.git.repoThe current repository for this request
req.git.serviceThe service name for this request
Possible service names are:
raw for raw file requests (if options.serve_static is enabled)browse for json browsing of the repos (if options.browse is enabled)commit for commits over http (if options.allow_commits is enabled)receive-pack for push requestsupload-pack for fetch requestsadvertise-refs for ref advertisement before push/pull requestsreq.git.authA (service) callback for authorising services.
req.git.pathThe path relative to the repo root for this request
FAQs
An express middleware acting as git-http-backend and more
We found that express-git demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.