Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
http-graceful-shutdown
Advanced tools
The http-graceful-shutdown npm package provides a way to gracefully shut down HTTP servers in Node.js applications. It ensures that the server stops accepting new connections and waits for existing connections to complete before shutting down, which helps in preventing data loss and ensuring a smooth shutdown process.
Basic Graceful Shutdown
This code demonstrates a basic setup for a graceful shutdown of an HTTP server. The server will stop accepting new connections and wait for existing connections to complete before shutting down.
const http = require('http');
const gracefulShutdown = require('http-graceful-shutdown');
const server = http.createServer((req, res) => {
res.writeHead(200, {'Content-Type': 'text/plain'});
res.end('Hello World\n');
});
server.listen(3000, () => {
console.log('Server running at http://127.0.0.1:3000/');
});
gracefulShutdown(server);
Custom Shutdown Handlers
This code demonstrates how to add custom shutdown handlers. The `onShutdown` option allows you to define tasks that should be completed before the server shuts down, such as cleaning up resources or logging.
const http = require('http');
const gracefulShutdown = require('http-graceful-shutdown');
const server = http.createServer((req, res) => {
res.writeHead(200, {'Content-Type': 'text/plain'});
res.end('Hello World\n');
});
server.listen(3000, () => {
console.log('Server running at http://127.0.0.1:3000/');
});
gracefulShutdown(server, {
onShutdown: () => {
return new Promise((resolve) => {
console.log('Custom shutdown tasks');
setTimeout(resolve, 1000);
});
}
});
Timeout for Shutdown
This code demonstrates how to set a timeout for the shutdown process. If the server does not shut down within the specified time, it will forcefully terminate.
const http = require('http');
const gracefulShutdown = require('http-graceful-shutdown');
const server = http.createServer((req, res) => {
res.writeHead(200, {'Content-Type': 'text/plain'});
res.end('Hello World\n');
});
server.listen(3000, () => {
console.log('Server running at http://127.0.0.1:3000/');
});
gracefulShutdown(server, {
timeout: 30000 // 30 seconds
});
The stoppable package provides similar functionality for gracefully shutting down HTTP servers. It allows you to stop accepting new connections and wait for existing connections to complete. Compared to http-graceful-shutdown, stoppable is more lightweight and has fewer configuration options.
The graceful-server package offers a way to gracefully shut down HTTP servers with additional features like handling multiple servers and custom shutdown hooks. It provides more flexibility and control compared to http-graceful-shutdown.
The terminus package is designed for graceful shutdowns and health checks for Node.js HTTP servers. It integrates with Kubernetes and other orchestration tools, providing more advanced features compared to http-graceful-shutdown.
_ _ _ __ _ _ _ _
| |_| |_| |_ _ __ ___ __ _ _ _ __ _ __ ___ / _|_ _| |___ __| |_ _ _| |_ __| |_____ __ ___ _
| ' \ _| _| '_ \___/ _` | '_/ _` / _/ -_) _| || | |___(_-< ' \ || | _/ _` / _ \ V V / ' \
|_||_\__|\__| .__/ \__, |_| \__,_\__\___|_| \_,_|_| /__/_||_\_,_|\__\__,_\___/\_/\_/|_||_|
|_| |___/
Gracefully shuts down node.js http server. More than 10 Mio downloads overall.
Version 3.0 just released. This version is fully backwards compatible to version 2.x but adds much better handling under the hood. More that 10 Mio downloads.
http-graceful-shutdown
manages a secure and save shutdown of your http server application:
$ npm install http-graceful-shutdown
const gracefulShutdown = require('http-graceful-shutdown');
...
// app: can be http, https, express, koa, fastity, ...
server = app.listen(...);
...
// this enables the graceful shutdown
gracefulShutdown(server);
PARENT Process (e.g. nodemon, shell, kubernetes, ...)
─────────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────
│ Signal (SIGINT, SIGTERM, ...)
│
│
(1) (2) v NODE SERVER (HTTP, Express, koa, fastity, ...)
▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇
│ │ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ │ <─ shutdown procedure
│ │ shutdown initiated │ │ │
│ │ │ │ │
│ │ │ │ (8) shutdown function (9) finally fn │
│ │ ▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄ │ │ ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ │
│ └ (3) (4) close │ └ (7) destroy │
│ preShutdown idle sockets │ remaining sockets │
│ │ │ (10)
serve │ serving req. (open connection) │ (5) └ SERVER terminated
▄▄▄│ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄┤ ^ blocked
^ │ ^ last request before │ │
│ │ │ receiving shutdown signal │ │
│ │ │ │ │
│ │ │ │ │
│ │ │ │ │
│ │ │ Long request │ │
Request │ V Resp │ V Resp. │
│ │ │ CLIENT
────────┴─────────┴─────────────────────────────────────────────────┴─────────────────────────────────────────────────────────
option | default | Comments |
---|---|---|
timeout | 30000 | timeout till forced shutdown (in milliseconds) |
signals | 'SIGINT SIGTERM' | define the signals, that should be handled (separated by SPACE) |
development | false | if set to true, no graceful shutdown is proceeded to speed up dev-process |
preShutdown | - | not time-consuming callback function. Needs to return a promise. Here, all HTTP sockets are still available and untouched |
onShutdown | - | not time-consuming callback function. Needs to return a promise. |
forceExit | true | force process.exit - otherwise just let event loop clear |
finally | - | small, not time-consuming function, that will be handled at the end of the shutdown (not in dev-mode) |
You can pass an options-object to specify your specific options for the graceful shutdown
The following example uses all possible options:
const gracefulShutdown = require('http-graceful-shutdown');
...
// app: can be http, https, express, koa, fastity, ...
server = app.listen(...);
...
// your personal cleanup function
// - must return a promise
// - the input parameter is optional (only needed if you want to
// access the signal type inside this function)
// - this function here in this example takes one second to complete
function shutdownFunction(signal) {
return new Promise((resolve) => {
console.log('... called signal: ' + signal);
console.log('... in cleanup')
setTimeout(function() {
console.log('... cleanup finished');
resolve();
}, 1000)
});
}
// finally function
// -- sync function
// -- should be very short (not time consuming)
function finalFunction() {
console.log('Server gracefulls shutted down.....')
}
// this enables the graceful shutdown with advanced options
gracefulShutdown(server,
{
signals: 'SIGINT SIGTERM',
timeout: 10000, // timeout: 10 secs
development: false, // not in dev mode
forceExit: true, // triggers process.exit() at the end of shutdown process
preShutdown: preShutdownFunction, // needed operation before httpConnections are shutted down
onShutdown: shutdownFunction, // shutdown function (async) - e.g. for cleanup DB, ...
finally: finalFunction // finally function (sync) - e.g. for logging
}
);
You can now trigger gracefulShutdown programatically (e.g. for tests) like so:
let shutdown
beforeAll(() => {
shutdown = gracefulShutdown(...)
})
afterAll(async () => {
await shutdown()
})
With the forceExit
option, you can define how your node server process ends: when setting forceExit
to false
, you just let the event loop clear and then the proccess ends automatically:
const gracefulShutdown = require('http-graceful-shutdown');
...
// app: can be http, https, express, koa, fastity, ...
server = app.listen(...);
...
// enable graceful shutdown with options:
// this option lets the event loop clear to end your node server
// no explicit process.exit() will be triggered.
gracefulShutdown(server, {
forceExit: false
});
If you want an explicit process.exit() at the end, set forceExit
to true
(which is the default).
If you want to get debug notes (debug is a dependency of this module), just set the DEBUG environment variable to enable debugging:
export DEBUG=http-graceful-shutdown
OR on Windows:
set DEBUG=http-graceful-shutdown
You can find examples how to use http-graceful-shutdown
with Express, Koa, http, http2, fastify in the examples
directory.
To run the examples, be sure to install debug and express, koa or fastify.
npm install debug express koa fastify
Version | Date | Comment |
---|---|---|
3.1.12 | 2023-02-11 | fix forceExit default value |
3.1.11 | 2022-11-18 | updated examples |
3.1.10 | 2022-11-17 | forceExit handling adapted |
3.1.9 | 2022-10-24 | updated docs, code cleanup |
3.1.8 | 2022-07-27 | updated docs, fixed typos |
3.1.7 | 2022-03-18 | updated dependencies, updated docs |
3.1.6 | 2022-02-27 | updated dependencies |
3.1.5 | 2021-11-08 | updated docs |
3.1.4 | 2021-08-27 | updated docs |
3.1.3 | 2021-08-03 | fixed handle events once (thanks to Igor Basov) |
3.1.2 | 2021-06-15 | fixed cleanupHttp() no timeout |
3.1.1 | 2021-05-13 | updated docs |
3.1.0 | 2021-05-08 | refactoring, added preShutdown |
3.0.2 | 2021-04-08 | updated docs |
3.0.1 | 2021-02-26 | code cleanup |
3.0.0 | 2021-02-25 | version 3.0 release |
2.4.0 | 2021-02-15 | added forceExit option (defaults to true) |
2.3.2 | 2019-06-14 | typescript typings fix |
2.3.1 | 2019-05-31 | updated docs, added typescript typings |
2.3.0 | 2019-05-30 | added manual shutdown (for tests) see docs below |
2.2.3 | 2019-02-01 | updated docs, debug |
2.2.2 | 2018-12-28 | updated docs, keywords |
2.2.1 | 2018-11-20 | updated docs |
2.2.0 | 2018-11-19 | added (optional) signal type to shutdown function - see example |
2.1.3 | 2018-11-06 | updated docs |
2.1.2 | 2018-11-03 | updated dependencies (version bump), updated docs |
2.1.1 | 2018-02-28 | extended isFunction to support e.g. AsyncFunctions |
2.1.0 | 2018-02-11 | bug fixing onShutdown method was called before server.close |
2.0.6 | 2017-11-06 | updated docs, code cleanup |
2.0.5 | 2017-11-06 | updated dependencies, modifications gitignore, added docs |
2.0.4 | 2017-09-21 | updated dependencies, modifications gitignore |
2.0.3 | 2017-06-18 | updated dependencies |
2.0.2 | 2017-05-27 | fixed return value 0 |
2.0.1 | 2017-04-24 | modified documentation |
2.0.0 | 2017-04-24 | added 'onShutdown' option, renamed 'callback' option to 'finally' |
1.0.6 | 2016-02-03 | adding more explicit debug information and documentation |
1.0.5 | 2016-02-01 | better handling of closing connections |
1.0.4 | 2015-10-01 | small fixes |
1.0.3 | 2015-09-15 | updated docs |
1.0.1 | 2015-09-14 | updated docs, reformated code |
1.0.0 | 2015-09-14 | initial release |
If you have ideas, comments or questions, please do not hesitate to contact me.
Sincerely,
Sebastian Hildebrandt, +innovations
Written by Sebastian Hildebrandt sebhildebrandt
The
MIT
License (MIT)Copyright © 2015-2023 Sebastian Hildebrandt, +innovations.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
gracefully shuts downs http server
The npm package http-graceful-shutdown receives a total of 126,154 weekly downloads. As such, http-graceful-shutdown popularity was classified as popular.
We found that http-graceful-shutdown demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.