Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Isomorphic call API or RPC as Promise for any nodejs/express application.
Server
npm install iso-call express body-parser --save
Client
A. Use browserify + aliasify to bundle your application and iso-call for browser:
npm install browserify aliasify --save-dev
Add these into your package.json
to enable aliasify:
"browserify": {
"transform": ["aliasify"]
}
B. Use webpack to bundle your applicatoin and iso-call for browser:
npm install webpack --save-dev
Add these into your webpack.config.js
to make iso-call works properly:
resolve: {
alias: {
"iso-call/polyfill": "babel-core/polyfill",
request: 'browser-request'
}
}
1. Enable Required ES Features
You should enable Promise and Object.assign() before using iso-call
in your application for both server and client.
A. BABEL way: when you write ES6 scripts
// For server side (in your main server script)
// Init ES6 environments for require()
require('babel/register')();
// For client side (in your main client script)
// use iso-call polyfill wrapper. require babelify
require('iso-call/polyfill');
B. Polyfill way: for most case
// For both server side and client side
// require object.assign and es6-promise
require('object.assign').shim();
require('es6-promise').polyfill();
You may also enable polyfill for client side by including any polyfill web service in your HTML before loading bundled JavaScript file:
<script src="https://cdn.polyfill.io/v1/polyfill.min.js"></script>
<script src="bundle.js"></script>
2. Setup your API
You should setup all your API or RPC list only for server, the best place is do it inside your server.js.
isocall = require('iso-call');
// Setup your API or RPC
isocall.addConfigs({
// API as {name: endpoint} list
yql: 'http://https://query.yahooapis.com/v1/public/yql',
graph: 'https://graph.facebook.com/v2.3/641060562',
// RPC as {name: function} list
getSqlData: function (params) {
return mysqlPromise(params.host, params.port);
}
// Also support RPC function with multiple parameters
getSQL: function (host, port, sql) {
return mysqlPromise(host, port, sql);
}
});
3. Setup middleware
You should setup middleware for express only at server side to wrap client side iso-call
.
var express = require('express');
var app = express();
isocall.setupMiddleware(app);
4. Call API or RPC!
Now you can call RPC isomorphically!!
// Works on both client and server side!
isocall.execute('rpcName', rpcParams).then(function (R) {
// Success, R = result
}).catch(function (E) {
// Failed , E = error
});
// Support with multiple parameters rpc function
isocall.execute('rpcName', rpcParam1, rpcParam2, ...).then(function (R) {
// Success, R = result
}).catch(function (E) {
// Failed , E = error
});
Or make isomorphic http request!!
// Works on both client and server side!
isocall.request('apiName', requestParams).then(function (R) {
// Success, R = {error: ... , response: ... , body: ...}
}).catch(function (R) {
// Failed , R = {error: ... , response: ... , body: ...}
});
iso.execute() at Server side
iso.execute() at Client side
iso.request() at both Server and Client side
Check our shell example to know more about isocall.execute(). There is another example works by webpack.
With isocall.execute() a RPC you can:
Check our YQL example to know more about isocall.request().
With isocall.request() an API you can:
Checkout our Context example to know more about context based RPC which can access request by this
.
With contexted isocall you can:
this
inside the RPC.Checkout our CSRF example to know more about how to prevent Cross-Site Request Forgery.
JSON.stringify()
to transfer isocall.execute()
result from server side to client side, so you can not receive data other than standard JSON data types. (TODO: support customized JSON serializer)result.response.body
object from isocall.request()
will be removed from result.response
to reduce transmission size; in most case it is same with result.body
.FAQs
Isomorphic api call for any nodejs/express application
The npm package iso-call receives a total of 2 weekly downloads. As such, iso-call popularity was classified as not popular.
We found that iso-call demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.