
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
express-version-router
Advanced tools
A router for express that manages api versioning.
npm install --save express-version-router
Set up express with the router:
var express = require('express');
var app = express();
var versionRouter = require('express-version-router');
var router = versionRouter();
var errorHandler = (req, res) => res.status(404).end('not found');
app.use(router, errorHandler); // will only call the errorHandler if it can't resolve the version
Set an endpoint to handle a specific version (version 1 in this case):
router.get('/myendpoint', 1, (req, res) => res.end('success'));
// curl http://myserver/v1/test => 200 success
// curl http://myserver/test?v=1 => 200 success
// curl -H "X-ApiVersion: 1" http://myserver/test => 200 success
// curl http://myserver/test => 404 not found
Set an endpoint to handle a version based on semver:
router.get('/myendpoint', /^2/, (req, res) => res.end('success'));
// curl http://myserver/v2/test => 200 success
// curl http://myserver/v2.1/test => 200 success
// curl http://myserver/v2.1.6/test => 200 success
// curl http://myserver/v3/test => 404 not found
Set an endpoint to handle a version based on a regular expression:
router.get('/myendpoint', /(3|4)/, (req, res) => res.end('success'));
// curl http://myserver/v3/test => 200 success
// curl http://myserver/v4/test => 200 success
// curl http://myserver/v5/test => 404 not found
Set an endpoint to accept multiple version using an array:
router.get('/myendpoint', [1, '^2', /(3|4)/], (req, res) => res.end('success'));
// curl http://myserver/v1/test => 200 success
// curl http://myserver/v2/test => 200 success
// curl http://myserver/v3/test => 200 success
// curl http://myserver/v4/test => 200 success
var versionRouter = require('express-version-router');
var router = versionRouter({
param: 'v',
header: 'X-ApiVersion',
responseHeader: 'X-ApiVersion',
passVersion: false
});
The router extends the standard express router and allows for all setting the the standard router has to be used. In addition the router has options specifically for the version mapping:
router.all(path, [version], [callback, ...] callback)
router.METHOD(path, [callback, ...] callback)
This method works the same way that the standard express router work, with the addition of an optional version parameter. Any string, number or regular expression is treated as a version that limits what requests this handler will respond to.
The path supports all the same options that the standard router does, only caveat is that regular expressions prevent the use of path parameters which are disabled in that case (parameter and header methods are still supported though). Instead you can make use of the regular expression subset that express has built in using strings.
The version can be either an array or a single instance of either:
A number - will match that number exactly
A string - will perform semver matching
A regular expression - will match the incoming version against it
Callbacks can be any handlers that are compatible with standard express handlers and as usual you can set multiple
handlers that will process a request in order. Handlers will receive a req object that now has two additional fields:
req.incomingVersion - The version that came in on the request
req.acceptedVersion - The version that the handler has been configured to accept
router.route(path)
This is the same as the original method. Note that versioning is not supported at this time for the param call.
router.use([path], [function, ...] function)
This is the same as the original method. Note that versioning is not supported at this time for the param call.
router.param(name, callback)
This is the same as the original method. Note that versioning is not supported at this time for the param call.
FAQs
A router for express that manages api versioning.
We found that express-version-router demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.