Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A rich framework for building restful API services. hapi is a configuration-centric framework in which authentication requirements, input validation, data caching and pre-fetching, developer documentation, and other essential facilities are provided out-of-the-box and enabled using simple JSON configuration objects. hapi enables developers to focus on writing reusable business logic instead of spending time with everything else.
For the latest updates and release information follow @hapijs on twitter.
Current version: 0.13.0
To demonstrate a basic example we will be creating a "hello world" service with a single API endpoint.
Start by creating a package.json by running
npm init
Now install hapi and have it saved to your package.json dependencies by running
npm install hapi --save
Next create an index.js file and add the following contents to it:
var Hapi = require('hapi');
// Create a server with a host and port
var server = new Hapi.Server('localhost', 8000);
// Define the route
var hello = {
handler: function (request) {
request.reply({ greeting: 'hello world' });
}
};
// Add the route
server.route({
method: 'GET',
path: '/hello',
config: hello
});
// Start the server
server.start();
Start the server with node .
and navigate to the website at 'http://localhost:8000/hello' in a browser and you will see the following output:
{"greeting":"hello world"}
To demonstrate one of the more powerful features in hapi we will change the 'hello' route to only respond whenever a 'name' is present on the querystring. Change the 'index.js' so that the 'hello' config object looks like the following:
var hello = {
handler: function (request) {
request.reply({ greeting: 'hello ' + request.query.name });
},
validate: {
query: {
name: Hapi.Types.String().required()
}
}
};
When you start the server with node .
and navigate to 'http://localhost:8000/hello' you will get a 400 response with an error explaining that 'name' is required. When the 'name' is omitted from the querystring the handler will not be called. However, if you do provide a 'name' it will be echoed out in the response. If you request 'http://localhost:8000/hello?name=John' then you will get the following response:
{"greeting":"hello John"}
To learn more about the various validation options you can read the validation section in the reference.
FAQs
HTTP Server framework
The npm package hapi receives a total of 57,544 weekly downloads. As such, hapi popularity was classified as popular.
We found that hapi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.