
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Don't have express generator, get it - $ npm install express-generator -g
Create an express app via express generorater. Note that we use jade templates to pass firewire data to the front end.
$ express myapp
Install dependancies
$ cd myapp
$ npm install
This will allow you to install firewire public modules. This is a good thing.
$ cd public
$ npm init
follow the prompts to create a blank app, which will create a node_modules folder when you install something into it
If you just added your public node_modules, then you'll need to get back to the root of your app!
Once you're back at the root of your app - install firewire
$ npm install firewire --save
Configure firewire
// index.js in express...
var express = require('express');
var router = express.Router();
var firewire = require("firewire");
// Use your own firebase url!!!
firewire.load = {
url : "https://your-firebase-project.firebaseio.com/"
};
Now you can use firewire in place of res.render to dynamically load a template and inject firebase data into it.
Like this...
router.get('/:page/id/:instance', function(req, res, next) {
firewire.wire(req,res,firewire.load,[
{"ids/:instance" : "home"},
{"pages/:page" : "page"}
]);
});
Using the above example, if you goto localhost:3000/admin/id/123
firewire will use admin.jade from your views folder
firewire will then exposefw.homeandfw.pageto the jade template.
fw.homewill be populated with data from https://your-firebase-project.firebaseio.com/ids/123
fw.pagewill be populated with data from https://your-firebase-project.firebaseio.com/pages/admin
Use that data in your jade templates #{fw.home} ... #{fw.page}
req.params.page = "page-name";Eg. This will route to admin.jade
/*Dynamic Page and Data Loader */
router.get('/admin/:instance', function(req, res, next) {
req.params.page = "admin";
firewire.wire(req,res,firewire.load,[
{"drafts/:instance" : "itemType"}
]);
});
You can also parse through static (non-firebase) data with firewire.load.static
router.get('/admin/:instance', function(req, res, next) {
req.params.page = "admin";
firewire.load.static ={'title' : "some static data"};
firewire.wire(req,res,firewire.load,[
{"drafts/:instance" : "itemType"}
]);
});
You can then plug this into a jade template with #{static.title}
Now if you have the following route set up
router.get('/:page/id/:instance', function(req, res, next) {
firewire.wire(req,res,firewire.load,[
{"ids/:instance" : "home"},
{"pages/:page" : "page"}
]);
});
And you've added data in firebase at:
ids
123 : "Some data"
pages
admin : "some data"
And you have a template called admin.jade in your views folder using #{fw.home} and / or #{fw.page}
And you run your app...
Use something like nodemon so your app automatically restarts on code changes
$ npm install nodemon -g
To run...
$ nodemon
Goto your browser at localhost:3000/admin/id/123 and your app should automatically route to admin.jade and plug in the firebase data.
Providing that you've set up your public node_modules (explained near top of page) then just...
$ cd public
then just $npm install ... whatever public module you want.
Check out...
FAQs
firewire | a modular ecosystem for building firebase apps in express.
We found that firewire demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.