Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A utility for getting geo-location information via HTML5 and IP look-ups, geocoding, address look-ups, distance and durations, timezone information and more...
© 2019, Onur Yıldırım (@onury). Please see the Disclaimer and License.
Geolocator.js is a utility for getting geo-location information, geocoding, address look-ups, distance & durations, timezone information and more...
See a Live Demo.
bower install geolocator
npm install geolocator
Example below, will attempt to get user's geo-location via HTML5 Geolocation and if user rejects, it will fallback to IP based geo-location.
Inside the <head>
of your HTML:
<script type="text/javascript" src="geolocator.min.js"></script>
<script type="text/javascript">
geolocator.config({
language: "en",
google: {
version: "3",
key: "YOUR-GOOGLE-API-KEY"
}
});
window.onload = function () {
var options = {
enableHighAccuracy: true,
timeout: 5000,
maximumWait: 10000, // max wait time for desired accuracy
maximumAge: 0, // disable cache
desiredAccuracy: 30, // meters
fallbackToIP: true, // fallback to IP if Geolocation fails or rejected
addressLookup: true, // requires Google API key if true
timezone: true, // requires Google API key if true
map: "map-canvas", // interactive map element id (or options object)
staticMap: true // get a static map image URL (boolean or options object)
};
geolocator.locate(options, function (err, location) {
if (err) return console.log(err);
console.log(location);
});
};
</script>
If you've enabled map
option; include the following, inside the <body>
of your HTML:
<div id="map-canvas" style="width:600px;height:400px"></div>
Read API documentation for lots of other features and examples.
doctype
is HTML5 (e.g. <!DOCTYPE html>
).geolocator.locate()
and geolocator.watch()
) from a secure origin (i.e. an HTTPS page). In Chrome 50+, Geolocation API is removed from unsecured origins. Other browsers are expected to follow.geolcoator.setGeoIPSource()
method to set a different Geo-IP source, but see the Caveats section before you do so.Mixed Content Restriction:
There are alternative Geo-IP services to be used with this library. But most of these services do not provide a free API over HTTPS (SSL/TLS). You need to subscribe for a premium API key to use HTTPS. The caveat is; HTML5 Geolocation API is restricted to HTTPS and when you enable the fallbackToIP
option, some browsers (such as Chrome and Firefox) will not allow mixed content. It will block HTTP content when the page is served over HTTPS.
Currently, Geolocator will use GeoJS by default which is free and supports HTTPS. Please use this service responsibly. For example, do NOT call locate()
or .locatebyIP()
on every user/request but only on site entrance. Their location or IP will not change suddenly unless they can teleport!..
Also, support GeoJS if you can so we can continue using this nice free service. If you know other free Geo-IP services over HTTPS, let me know and we can add/use them as alternatives.
Isomorphic Applications / SSR Support:
This library currently only works on client-side (browser). Any kind of server-side functionality (including Server Side Rendering) is not yet oficially supported.
There is a discussion about at least preventing it from throwing on server; or maybe adding support for some (if not all) methods to work on server. If you're interested and willing to contribute;
Geolocator v2 is written in ES2015 (ES6), compiled with Babel, bundled with Webpack and documented with Docma.
See version changes here.
MIT. See the Disclaimer and License.
2.1.5 (2019-01-09)
locateByIP()
method would fail due to external service being shut down. Added a new (default) Geo-IP service provider to GeoJS with HTTPS
support.getIP()
method now uses XHR request instead of JSONP, since CORS is supported by the service.xhr
to true
when passing a new Geo-IP source to setGeoIPSource()
method.)timeout
option is changed to 6000
for .locate()
method.FAQs
A utility for getting geo-location information via HTML5 and IP look-ups, geocoding, address look-ups, distance and durations, timezone information and more...
The npm package geolocator receives a total of 2,233 weekly downloads. As such, geolocator popularity was classified as popular.
We found that geolocator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.