Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
mongodb-rest
Advanced tools
This project is no longer abandoned!
Thanks so much to Tom for starting this project that has been so useful. I'm planning on moving this project forward now and hopefully others are willing to help.
As Tom has said this REST server has no security and is not fit for use in production. So be warned! Security issues may or may not be addressed in the future.
I have found this REST server to be invaluable for rapid prototyping web applications. When you don't care about security and you just need to try something out without investing the time to build a proper secure REST API.
Recent updates:
Added support for Access-Control-Allow-Credentials in the configuration.
I have removed the flavor option of mongodb-rest. Sorry if you were using this, I think this kind of transformation is best done in the client.
mongodb-rest now works with dependencies updated to latest versions.
Added better error checking for mongodb-rest configuration. Also some logical defaults when configuration is incomplete.
Added handling for mongodb errors.
Removed Jade dependency.
Can now get a list of database names.
Can now get a list of collection names for a specified database.
It is now easier to start and configure the server procedurally.
REST API output is now human readable by default.
MongoBD server and database options can now be specified in the config file.
mongodb-rest - REST server for MongoDB
This is a REST server for MongoDB using Node, using Express and the native node.js MongoDB driver.
Installation is via npm:
npm install mongodb-rest
You can install globally using -g:
npm install -g mongodb-rest
Now issue mongodb-rest
on the command line and the server should start.
NOTE: Make sure you are running a MongoDB database in addition to the mongodb-rest server.
After installation you can quickly test it by issuing the following from the command line:
curl -d '{ "A1" : 201 }' -H "Content-Type: application/json" http://localhost:3000/test/example1
This should add a document to the "test" db.example1 collection:
{
"A1": 201,
"_id": ObjectId("4e90e196b0c7f4687000000e")
}
mongodb-rest can easily be started programmatically by 'requiring' the module and calling startServer
.
var mongodbRest = require('mongodb-rest');
mongodbRest.startServer();
You can optionally pass in a configuration object:
mongodbRest.startServer(config);
When starting from the command line you should have config.json
in the current working directory.
When starting the server programmatically you can pass in a Javascript object for mongodb-rest configuration.
Here is an example JSON configuration object:
{
"db": {
"port": 27017,
"host": "localhost"
},
"server": {
"port": 3000,
"address": "0.0.0.0"
},
"accessControl": {
"allowOrigin": "*",
"allowMethods": "GET,POST,PUT,DELETE,HEAD,OPTIONS",
"allowCredentials": false
},
"mongoOptions": {
"serverOptions": {
},
"dbOptions": {
"w": 1
}
},
"humanReadableOutput": true
}
The db
and server
options both default if not specified.
mongoOptions
specifies MongoDB server and database connection parameters. These are passed directly to the MongoDB API.
Valid options under serverOptions
are documented here: http://mongodb.github.io/node-mongodb-native/api-generated/server.html.
auto_reconnect
is automatically enabled, don't override this or mongodb-rest may not work as expected.
Valid options under dbOptions
are documented here: http://mongodb.github.io/node-mongodb-native/api-generated/db.html.
w
(write concern) is set to 1 so that acknowledgement of the write is recieved by mongodb-rest, currently this must be enabled for error checking.
Set collectionOutputType
to csv
to returns collections as csv data rather than json.
If you are configuring the server procedurally you can assign a Javascript function to transformCollection
which will transform each collection before returning it via HTTP.
The accessControl
options allow you to set the following headers on the HTTP response:
Help for these headers can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
Supported REST API requests:
GET /dbs
- Returns the names of all databases.GET /<db>/
- Returns names of all collections in the specified database.GET /<db>/<collection>
- Returns all documents in the specified collection.GET /<db>/<collection>?output=csv
- Returns all documents in collection in csv format.GET /<db>/<collection>?query=%7B%22isDone%22%3A%20false%7D
- Returns all documents satisfying query.GET /<db>/<collection>?query=%7B%22isDone%22%3A%20false%7D&limit=2&skip=2
- Ability to add options to query (limit, skip,
etc)GET /<db>/<collection>/id
- Returns document with idPOST /<db>/<collection>
- Insert new document in collection (document in POST body)PUT /<db>/<collection>/id
- Update document with id (updated document in PUT body)DELETE /<db>/<collection>/id
- Delete document with idFlavors:
Content Type:
application/json
is used as Content-Type when using POST/PUT with request bodies.Dependencies:
Integration tests use jasmine-node.
Run this command from the main folder:
jasmine-node .\ --verbose
https://travis-ci.org/ashleydavis/mongodb-rest
Roadmap:
https://trello.com/b/OzRxPSjO/mongodb-rest-roadmap
Testing:
FAQs
REST API Server for MongoDB
The npm package mongodb-rest receives a total of 42 weekly downloads. As such, mongodb-rest popularity was classified as not popular.
We found that mongodb-rest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.