http4js - npm Package Compare versions

Comparing version 3.0.2 to 3.1.0

client/HttpsClient.ts

 import * as https from "https";
 import {HeadersType, Req, Res, ResOf} from "../";
+import * as fs from "fs";
 
@@ -10,2 +11,3 @@ export async function HttpsClient(req: Req): Promise<Res> {
         method: req.method,
+        // ca: fs.readFileSync('src/ssl/my-root-ca.cert.pem'),
     };
@@ -12,0 +14,0 @@

package.json

 {
   "name": "http4js",
-  "version": "3.0.2",
+  "version": "3.1.0",
   "description": "A lightweight HTTP toolkit",
@@ -10,2 +10,4 @@ "main": "dist/index.js",
     "test": "mocha --require ts-node/register --watch-extensions ts,tsx 'src/test/**/*.{ts,tsx}'",
+    "test-ssl": "mocha --require ts-node/register --watch-extensions ts,tsx 'src/ssl/**/*.{ts,tsx}'",
+    "test-all": "tsc && mocha --require ts-node/register --watch-extensions ts,tsx 'src/{test,ssl}/**/*.{ts,tsx}'",
     "build": "tsc",
@@ -32,2 +34,3 @@ "app": "tsc; node index.js"
     "mocha": "5.0.0",
+    "ssl-root-cas": "^1.2.5",
     "ts-node": "4.1.0",
@@ -34,0 +37,0 @@ "typescript": "2.9.2"

README.md

@@ -101,2 +101,3 @@ # http4js
 
+
 ## To dos
@@ -111,2 +112,3 @@
   - docs
+  - pull out into a module
 - possibly have a Headers class for dicing with headers, not just an object
@@ -116,1 +118,69 @@ - provide pivoted routing (?)
 - streaming
+
+
+## Running HTTPS Server tests
+
+Follow these [Instructions](https://stackoverflow.com/questions/19665863/how-do-i-use-a-self-signed-certificate-for-a-https-node-js-server)
+to create your own certificates in order to run an HTTPS server locally.
+
+Then run 
+
+```bash
+yarn test-ssl
+```
+
+
+[Commands](https://github.com/Daplie/nodejs-self-signed-certificate-example/blob/master/make-root-ca-and-certificates.sh)
+
+I followed slightly differently in http4js: 
+
+```bash
+cd src/test/ssl
+
+# create your own CA key
+openssl genrsa \
+  -out my-root-ca.key.pem \
+  2048
+
+# Create your own CA cert using CA key
+# Self-sign your Root Certificate Authority
+# Since this is private, the details can be as bogus as you like
+openssl req \
+  -x509 \
+  -new \
+  -nodes \
+  -key my-root-ca.key.pem \
+  -days 1024 \
+  -out my-root-ca.cert.pem \
+  -subj "/C=US/ST=Utah/L=Provo/O=ACME Signing Authority Inc/CN=example.com"
+
+# Create a private key
+# Create a Device Certificate for each domain,
+# such as example.com, *.example.com, awesome.example.com
+# NOTE: You MUST match CN to the domain name or ip address you want to use
+openssl genrsa \
+  -out key.pem \
+  2048
+
+
+# Make a Certificate Signing Request (csr) to then create a CA signed cert below
+# Create a request from your Device, which your Root CA will sign
+openssl req -new \
+  -key key.pem \
+  -out csr.pem \
+  -subj "/C=US/ST=Utah/L=Provo/O=ACME Tech Inc/CN=localhost"
+
+# Create CA signed cert
+# Sign the request from Device with your Root CA
+# -CAserial my-root-ca.srl
+openssl x509 \
+  -req -in csr.pem \
+  -CA my-root-ca.cert.pem \
+  -CAkey my-root-ca.key.pem \
+  -CAcreateserial \
+  -out cert.pem \
+  -days 500
+
+# Create fullchain, your new cert followed by CA cert
+cat cert.pem my-root-ca.cert.pem > fullchain.pem
+```

servers/NativeHttpServer.js

@@ -46,3 +46,2 @@ "use strict";
         this.server = http.createServer();
-        return this;
     }
@@ -49,0 +48,0 @@ NativeHttpServer.prototype.registerCatchAllHandler = function (routing) {

servers/NativeHttpServer.ts

 import * as http from "http";
-import {Routing, head} from "../core/Routing";
+import {Routing} from "../core/Routing";
 import {Res} from "../core/Res";
@@ -7,3 +7,3 @@ import {Req} from "../core/Req";
 import {HeaderValues} from "../core/Headers";
-import {KeyValues, Form, HeadersType} from "../core/HttpMessage";
+import {Form, HeadersType} from "../core/HttpMessage";
 
@@ -19,3 +19,2 @@ export class NativeHttpServer implements Http4jsServer {
         this.server = http.createServer();
-        return this;
     }
@@ -22,0 +21,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

122966

increased by10.87%

Number of package files

60

increased by5.26%

Lines of code

2804

increased by8.47%

Number of lines in readme file

184

increased by61.4%

Worsened metrics

Dev dependency count

10

increased by11.11%

Number of low supply chain risk alerts

1

increased byInfinity%

Number of medium supply chain risk alerts

4

increased by33.33%

No dependency changes