Security News
PyPI’s New Archival Feature Closes a Major Security Gap
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
light-config
Advanced tools
Share specific subsets of your server-side config with the browser
npm i light-config --save
Say one has the following JSON config for a Node.js app:
{
"version": "1.0.0",
"environment": "production1",
"services": {
"payments": {
"url": "https://api/payments"
},
"users": {
"url": "https://api/users"
}
},
"clusters": {
[...]
},
"messageQueue": {
[...]
}
}
If one wishes to retrieve the services
property in the browser to make a client-side XMLHttpRequest, it becomes necessary to pass the configuration to the client. In the above example, the other properties are only relevant to the server, and passing a large config in its entirety will result in an increased response size.
Light Config allows one to create a subset of a config. For example:
// ECMAScript 5: var lightConfig = require('light-config');
import lightConfig from 'light-config';
import serverConfig from './serverConfig.json';
const clientConfig = lightConfig(serverConfig, ['environment', 'services.users']);
/* Outputs:
* {
* environment: 'production1',
services: {
users: {
url: 'https://api/users'
}
}
* }
console.log(clientConfig);
As can be seen, the format of the server config is maintained (i.e. clientConfig.services.users.url). This is particularly useful when developing isomorphic apps.
clientConfig
can be passed to the client in various ways. In Express, one could pass it as a cookie header:
response.set('Set-Cookie', JSON.stringify(clientConfig));
Alternatively, one could pass it to a template and attach it to the window:
response.render('view.handlebars', { clientConfig: JSON.stringify(clientConfig) });
// view.handlebars
<script>window.NAMESPACE.config = {{{ clientConfig }}}</script>
lightConfig(serverConfig, propertyTrees)
Returns a subset of the specified server config object according to the propertyTrees
array, which can contain root properties (e.g. ['environment']
) or deep properties (e.g. ['services.users']
); the latter honours the existing contract.
FAQs
Share specific subsets of your server-side config with the browser
The npm package light-config receives a total of 2 weekly downloads. As such, light-config popularity was classified as not popular.
We found that light-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
Research
Security News
Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.
Security News
CISA's KEV data is now on GitHub, offering easier access, API integration, commit history tracking, and automated updates for security teams and researchers.