Security News
Cloudflare Adds Security.txt Setup Wizard
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
express-reaccess
Advanced tools
Express/Connect middleware to manage API access on a RegExp basis
Express middleware to check user access based on the ressources URIs and HTTP methods.
See those slides to know more about the reaccess
project principles.
var reaccess = require('express-reaccess');
app.use(reaccess({
rightsProps: ['_rights'],
valuesProps: ['_user'],
}));
Assumming a middleware placed before the above example and adding properties like this on the request object for a given authenticated user:
req._user = {
id: 1,
login: 'nfroidure',
organization: {
id: 1,
name: 'simplifield',
},
};
req._rights = [{
path: '/users/:login',
methods: reaccess.METHODS ^ reaccess.DELETE,
}, {
path: '/organisations/:organization.name',
methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,
}, {
path: 'public/(.*)',
methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,
}];
Then, the user will be able to access the following URI/method couples:
Warning: Since this middleware is based on RegExp, you have to be aware of RegExp special chars. By example, the following rules:
req._rights = [{
path: '/blog/posts/([0-9]+)/?page=([0-9]+)',
methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,
}];
Will allow access to 'blog/posts/1page=1' which is probably not what you want. So, do not forget to escape special chars:
req._rights = [{
path: '/blog/posts/([0-9]+)/\\?page=([0-9]+)',
methods: reaccess.OPTIONS | reaccess.HEAD | reaccess.GET,
}];
The best is to unit test your access rules. Note that the ^ and $ chars are respectively added to the begin/end of the regular expression before executing her.
Type: Object
The options of the reaccess middleware.
Type: Array
of String
s
Default: 'user.rights'
The properties in wich the user rights will be read. This property must be filled on the request object by any other middleware.
This property must contain an Array
of object of this kind :
req.user.rights = [{
path: '/organizations/:orgId/users.json'
methods: reaccess.GET | reaccess.POST
}];
Type: Array
of String
s
The properties in which any templated value found in the path must be searched for.
By example, if the user rights are the following :
req.user.rights = [{
path: '/organizations/:org.id/users.json'
methods: reaccess.GET | reaccess.POST
}];
He will be able to access this URI /organizations/1/users.json if a previously
set middleware have set the req.user.org.id
to 1
and options.valuesProps
to
['user']
.
Type: Error
constructor
Default: Error
Allows to use your own Error contructor for reaccess access errors.
Type: String
Default: Unauthorized access!
Allows to define your own error message. Note this middleware will not throw 401 responses for you. This is your responsibility to do so in your own error handler middleware. Defining a custom access error message could help detect when to answer with a 401 status code.
express-reaccess
comes with some convenience static methods to deal with methods
properties.
Return a boolean indicating if the given method/path matches the given rights.
Extract rights from the actual request.
Extract template values from the actual request.
Return an array of strings from the methods property of a right.
Return the methods value of a right from an array of strings.
Reaccess use bitwise operators to match methods. The reaccess function provides static constants to help you make cleaner code.
Type: Number
Value: 1
Type: Number
Value: 2
Type: Number
Value: 4
Type: Number
Value: 8
Type: Number
Value: 16
Type: Number
Value: 32
Type: Number
Value: 64
Type: Number
Value: 7
Type: Number
Value: 120
Type: Number
Value: 127
express-reaccess supports multivalued path templates. The following rights/values couple:
req._rights = [{
path: '/organizations/:organizations.#.id/users/:id.json'
methods: reaccess.GET | reaccess.POST
}];
req.user.organizations = [{
id: 1,
name: 'FranceJS'
}, {
id: 2,
name: 'ChtiJS'
}];
req.user.id = 3;
Will give access to GET/POST /organizations/1/users/3.json and GET/POST /organizations/2/users/3.json.
You also can use the express-reaccess middleware several times to bring a fine access control of your API to your consumers:
// Access control based on the pricing plan of the user organization
app.use(reaccess({
rightsProps: ['pricingPlan.rights'],
valuesProps: ['organization']
}));
// Access control based on the user rights set per each organization administrator
app.use(reaccess({
rightsProps: ['user.rights'],
valuesProps: ['user']
}));
To debug access checks, just use the DEBUG=express-reaccess
environnement variable.
If you use AngularJS for your frontend, you may be interested by the
angular-reaccess
module.
FAQs
Express/Connect middleware to manage API access on a RegExp basis
The npm package express-reaccess receives a total of 73 weekly downloads. As such, express-reaccess popularity was classified as not popular.
We found that express-reaccess demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
Security News
The Socket Research team breaks down a malicious npm package targeting the legitimate DOMPurify library. It uses obfuscated code to hide that it is exfiltrating browser and crypto wallet data.
Security News
ENISA’s 2024 report highlights the EU’s top cybersecurity threats, including rising DDoS attacks, ransomware, supply chain vulnerabilities, and weaponized AI.