
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
grpc-dynamic-gateway
Advanced tools
This will allow you to provide a REST-like JSON interface for your gRPC protobuf interface. grpc-gateway requires you to genrate a static version of your interface in go, then compile it. This will allow you to run a JSON proxy for your grpc server without generating/compiling.
npm -g grpc-dynamic-gateway
grpc-dynamic-gateway DEFINITION.proto
Usage: grpc-dynamic-gateway [options] DEFINITION.proto [DEFINITION2.proto...]
Options:
-?, --help, -h Show help [boolean]
--port, -p The port to serve your JSON proxy on [default: 8080]
--grpc, -g The host & port to connect to, where your gprc-server is
running [default: "0.0.0.0:5051"]
-I, --include Path to resolve imports from
--ca SSL CA cert
--key SSL client key
--cert SSL client certificate
--mountpoint, -m URL to mount server on [default: "/"]
You can use it in your code, too, as express/connect/etc middleware.
npm i -S grpc-dynamic-gateway
const grpcGateway = require('grpc-dynamic-gateway')
const express = require('express')
const bodyParser = require('body-parser')
const app = express()
app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: false }))
// load the proxy on / URL
app.use('/', grpcGateway(['api.proto'], '0.0.0.0:5051'))
const port = process.env.PORT || 8080
app.listen(port, () => {
console.log(`Listening on http://0.0.0.0:${port}`)
})
With SSL, you will need the Cert Authority certificate, client & server signed certificate and keys.
I generated/signed my demo keys like this:
openssl genrsa -passout pass:1111 -des3 -out ca.key 4096
openssl req -passin pass:1111 -new -x509 -days 365 -key ca.key -out ca.crt -subj "/C=US/ST=Oregon/L=Portland/O=Test/OU=CertAuthority/CN=localhost"
openssl genrsa -passout pass:1111 -des3 -out server.key 4096
openssl req -passin pass:1111 -new -key server.key -out server.csr -subj "/C=US/ST=Oregon/L=Portland/O=Test/OU=Server/CN=localhost"
openssl x509 -req -passin pass:1111 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
openssl rsa -passin pass:1111 -in server.key -out server.key
openssl genrsa -passout pass:1111 -des3 -out client.key 4096
openssl req -passin pass:1111 -new -key client.key -out client.csr -subj "/C=US/ST=Oregon/L=Portland/O=Test/OU=Client/CN=localhost"
openssl x509 -passin pass:1111 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
openssl rsa -passin pass:1111 -in client.key -out client.key
Then use it like this:
grpc-dynamic-gateway --ca=ca.crt --key=client.key --cert=client.crt api.proto
You can use SSL in code, like this:
const grpc = require('grpc')
const credentials = grpc.credentials.createSsl(
fs.readFileSync(yourca),
fs.readFileSync(yourkey),
fs.readFileSync(yourcert)
)
app.use('/', grpcGateway(['api.proto'], '0.0.0.0:5051', credentials))
Protoc can generate a swagger description of your RPC endpoints, if you have protoc-gen-swagger installed:
protoc DEFINITION.proto --swagger_out=logtostderr=true:.
There is one required port, and a volume that will make it easier:
/api.proto
- your proto file8080
- the exposed portThere is also an optional environment variable: GRPC_HOST
which should resolve to your grpc sever (default 0.0.0.0:5051
)
So to run it, try this:
docker run -v $(pwd)/your.proto:/api.proto -p 8080:8080 -e "GRPC_HOST=0.0.0.0:5051" -rm -it konsumer/grpc-dynamic-gateway
If you want to do something different, the exposed CMD
is the same as grpc-dynamic-gateway
CLI, above.
FAQs
Like grpc-gateway, but written in node and dynamic.
The npm package grpc-dynamic-gateway receives a total of 46 weekly downloads. As such, grpc-dynamic-gateway popularity was classified as not popular.
We found that grpc-dynamic-gateway demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.