
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Router middleware for koa v2.
feedbacks are welcome
all)# with npm
$ npm install koa-66
$ with yarn
$ yarn add koa-66
const Koa = require('koa');
const Router = require('koa-66');
const app = new Koa();
const router = new Router();
const mainRouter = new Router();
router.param('id', (ctx, next, id) => {
ctx.yolo = id;
return next();
});
router.use(async function(ctx, next) {
ctx.a = " ";
await next();
});
router.get('/:id', (ctx, next) => {
return next().then(() => {
ctx.body += ctx.a + ctx.yolo;
})
});
router.get('/:id', async function(ctx) {
ctx.body = await Promise.resolve('hello');
});
mainRouter.mount('/pouet', router);
app.use(mainRouter.routes());
app.listen(1664);
// GET http://localhost:1664/pouet/world
// => hello world
const Koa = require('koa');
const Router = require('koa-66');
const app = new Koa();
const router = new Router();
app.use(async function(ctx, next) {
try {
await next();
}catch(e){
if (e.status === 405) {
ctx.status = 405;
ctx.set(e.headers);
}
}
})
router.get('/', (ctx) => ctx.body = 'hello');
app.use(router.routes({throw: true}));
app.listen(1664);
// > curl http://localhost:1664/ -I -X POST
//
// HTTP/1.1 405 Method Not Allowed
// allow: HEAD, GET
// Content-Type: text/plain; charset=utf-8
// Content-Length: 18
// Date: Wed, 04 Nov 2015 10:29:06 GMT
// Connection: keep-alive
I don't know if Plugin is a good term for this feature. The goal was to add cappability to register some middleware on a main Router that will be inject via config object on different route. (ex: authentication or acl behaviour). Why? Because I am lazy to require some middleware in all my router script with generaly relatif path...
So I decided to add the possibility to inject an object at first parameter (that will be a config object) and adding an extra middleware that will be inject in middleware stack. To register this plugin just use a plugin()method.
const Router = require('koa-66');
const main = new Router();
// you can use multiple middleware as arguments or array
main.plugin('authent', (ctx, next) => {
// pick plugin config object on ctx.state.plugins.
// here ctx.state.plugins.authent === true;
// do stuff inject user on context for example
return next();
//or throw or do nothing that will stop execution of router stack
})
main.plugin('acl', (ctx, next) => {
// here ctx.state.plugins.acl === ['admin'];
// do stuff check role via ctx.state.plugins.acl for example
return next();
//or throw or do nothing that will stop execution of router stack
})
const router = new Router();
router.use({authent: true});
//options here is a boolean,
//but you can pass everything you want,
//and it will be inject as options
router.get('/private', {acl:['admin']},
ctx => ctx.body = 'private'
)
main.mount('/api', router);
...
// order of call /api/private
// 1 plugin authent
// 2 plugin acl
// 3 real middleware
# npm test
FAQs
Router middleware for koa v2
The npm package koa-66 receives a total of 912 weekly downloads. As such, koa-66 popularity was classified as not popular.
We found that koa-66 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.