
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
grant-server
Advanced tools
Packaged grantjs OAuth server so you can run it immediately via command line. Perfect for microservice architecture.
This module is a packaged Grant OAuth proxy server. That means that you can just install this package and run grant-serve
to have a proxy OAuth server running.
npm install grant-server
run it:
grant-serve
After installing, you will need a grant configuration file to set up different OAuth providers. By default, the module looks for grant.config.json
file in the currently executing directory. The server will automatically watch for changes in the configuration file and it will automatically reload.
example configuration file with Google auth:
{
"defaults": {
"origin": "http://localhost:3000",
"prefix": "/oauth"
},
"google": {
"key": "CLIENT_ID",
"secret": "CLIENT_SECRET",
"callback": "https://redirect-user-to-your-app.com",
"scope": ["openid"]
}
}
By using the file above we are enabling google OAuth point on http://localhost:3000/oauth/google
, and we are asking for OpenID
scope. After the tokens have been acquired, the caller will be redirected to https://redirect-user-to-your-app.com
with the tokens available via query parameters.
-c
or --config
Grant configuration file. If not provided, by default server will look for grant.config.json
in the currently executing directory.
-d
or --debug
Enable writing tokens to stdout
. It uses request-logs module. If only the flag is passed it will default to res,json
otherwise you can customize what the output will be e.g. -d res,req,json,body
p
or --proxy
By default internal express
app will have trust proxy
flag set to true
. You can pass in false
to disable the proxy. Or use any of the options supported by the express app
Docker image is available on docker hub. Image is based on github releases, so it's always up to date.
Pull the image:
docker image pull ivandotv/grant-server
Run the container:
docker run -it -v /config-dir:/opt/grant-server/config-dir ivandotv/grant-server -d -c config/config.json
Few things to keep in mind when using the docker image.
/opt/grant-server
directory inside the container.-v config.json:/opt/grant-server/config.json
Automatic reloading of the server will not work, because the server will not see the changes in the file.
Better option is to mount the directory where configuration file is located: -v /config-dir:/opt/grant-server/config-dir
and then pass the -c
flag to the container like so: -c config/config.json
.FAQs
Packaged grantjs OAuth server so you can run it immediately via command line. Perfect for microservice architecture.
The npm package grant-server receives a total of 0 weekly downloads. As such, grant-server popularity was classified as not popular.
We found that grant-server demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.