
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
HTML5 boilerplate (H5BP) server config for node.js.
h5bp for node.js follows the guidelines of the Apache version:
www.yoursite.tld to yoursite.tld or vice versa.It also focuses on offering additional features such as on-the-fly script concatenation using CommonJS or AMD.
npm install --save h5bp
var h5bp = require('h5bp');
var app = h5bp.createServer({ root: __dirname + '/public' });
app.listen(3000);
app is an instance of an express application. You can add additional middlewares or routes if you like.
var express = require('express'),
h5bp = require('h5bp');
var app = express();
app.use(h5bp({ root: __dirname + '/public' }));
// in order to serve files, you should add the two following middlewares
app.use(express.compress());
app.use(express.static(__dirname + '/public'));
app.listen(3000);
If you want to split your application source files but only serve one file, you can use the on-the-fly concatenation. If you are familiar with node.js, you can use the CommonJS style. You can also use the AMD style.
app.use(h5bp({
root: __dirname + '/public',
scripts: {
files: ['app.js'],
processor: 'commonjs' // can also be "amd"
}
}));
At the first request hit to /app.js, the server will compile, cache and serve the file. Any subsequent request will
serve the cached file without any performance impact.
So, this feature is meant to be used with the cache busting mechanism in order to ensure the client always has the latest resource version. If you restart your server, the cache will be flushed.
Note that the next release will provide a development mode where the server will simply disable its cache and always serve the latest version of the file.
There are several options you can pass to the middleware.
app.use(h5bp(options));
Tells the filesystem path to the root directory of static resources. This options is mandatory if you serve static files.
Forces www if true, forces non-www if false, does nothing if not defined. By default, this is disabled.
Enables CORS for everything. By default this is disabled.
Enables access to dotfiles. By default this is disabled.
Tells which scripts to concatenate.
This is an object with the following properties:
This is an array of files to concatenate. Their path is relative to the root option. Their URL will be absolute.
For example, if you set files to ['scripts/app.js'] and root to /home/h5bp/app/:
/home/h5bp/app/scripts/app.js.yoursite.tld/scripts/app.js.Tells which processor to use for scripts concatenation.
For now, it can be one of the following values:
commonjs: will concatenate files using the CommonJS method (require/exports).amd: will concatenate files using the AMD method (require/define).The h5bp.createServer function takes the same options, plus additional ones.
The callback is optional. It is a custom middleware that you can register directly if you want to.
h5bp.createServer(options, [callback]);
Tells which type of server you want to use.
It can be one of the following values:
express: uses express, this is the default value.connect: uses connect.Tells if you want to log server requests or not. This can also be an object containing logger options.
Tells if you want to serve gzipped content or not. By default this is true.
If you are using h5bp as a middleware, we strongly encourage you to use the compress middleware provided by
express / connect.
FAQs
HTML5 boilerplate (H5BP) inspired server config for node.js
The npm package h5bp receives a total of 11 weekly downloads. As such, h5bp popularity was classified as not popular.
We found that h5bp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.