Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
koa-requestid
Advanced tools
Install the package via yarn
:
❯ yarn add koa-requestid
or via npm
:
❯ npm install koa-requestid --save
Use koa-requestid
as a middleware for a koa app. By default, it generates a unique uuid (v4) and exposes it on the response via the Request-Id
header. The id is also saved as part of the request state.
In the following example, the generated uuid is manually exposed on the body for debugging purposes:
const Koa = require('koa');
const requestId = require('koa-requestid');
const app = new Koa();
app.use(requestId());
app.use(async ctx => {
ctx.body = ctx.state.id;
});
app.listen(3000);
Execute a request to the running app:
❯ curl -v http://localhost:3000
< HTTP/1.1 200 OK
< Request-Id: cc0f12c7-f3b6-4c86-94c2-8c4ce7751651
cc0f12c7-f3b6-4c86-94c2-8c4ce7751651
Sometimes it is also useful to pass a custom id via a request header or query string, specifically in debugging sessions. Please note that the input id is not sanitized, so the usual precautions apply.
Using the above snippet to send a custom via the default Request-Id
header:
❯ curl -v -H 'Request-Id: foobar' http://localhost:3000
< HTTP/1.1 200 OK
< Request-Id: foobar
foobar
or using a query string parameter (default is requestId
):
❯ curl -v http://localhost:3000?requestId=foobar
< HTTP/1.1 200 OK
< Request-Id: foobar
foobar
options
(object): A dictionary of options.expose
(string|false): The name of the header to expose the id on the response, or false
to disable.header
(string|false): The name of the header to read the id on the request, or false
to disable.query
(string|false): The name of the header to read the id on the query string, or false
to disable.Example:
const Koa = require('koa');
const requestId = require('koa-requestid');
const app = new Koa();
app.use(requestId({
expose: 'X-Request-Id',
header: 'X-Req-Id',
query: 'request-id'
}));
This configuration would expose every generated request id via the X-Request-Id
response header and accept a custom id via the X-Req-Id
header or request-id
query string parameter.
❯ yarn test
npm version [<new version> | major | minor | patch] -m "Release %s"
MIT
FAQs
A middleware that adds a request id to a koa application
We found that koa-requestid demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.