
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
serve-gridfs
Advanced tools
Based on serve-static
Tested on node 7.x, npm 4.x
Require node-mongodb-native 2.x
$ npm i serve-gridfs
import serveGridfs from 'serve-gridfs'
Create a new middleware function to serve files from a mongodb gridfs collection. The file to be served is based on req.url. In a default setting, when a file is not found, this middleware call next(), instead of returning 404, to be in line with the express serve-static middleware.
Internally, this middleware use promised based mongo client, so pass in the connection detail here.
const mongoConnection = MongoClient.connect('mongodb://localhost:27017/myApp')
All options are optional
| Key | Type | Default | Note |
|---|---|---|---|
| bucketName | string | 'fs' | Default set by mongodb |
| chunkSizeBytes | number | 261120 | 255 * 1024 |
| writeConcern | object | null | |
| readPreference | object | null | |
| byId | bool | true | The file sepecified in req.url by default is the mongodb _id, if set to false, mongodb will look for filename instead of _id, see example below. When multiple files have the same filename, by default, the latest file will be served |
| acceptRanges | bool | true | Setting to false will not send Accept-Ranges and ignore the contents of the Range request header |
| cacheControl | bool or string | true | Setting to false will disable the Cache-Control in a response header. The default is public, max-age=0. You can set this to any string, which will also overide the maxAge key below. |
| maxAge | number | 0 | Set this to whatever you like in seconds |
| etag | bool | true | md5 generated by mongodb gridfs |
| lastModified | bool | true | |
| fallthrough | bool | true | By default, when the file specified in req.url cannot be found in mongodb gridfs collection, a next() will be called without an error. If set to false, a next(new Error('FileNotFound)) will be called. Also, setting to false will throw a 405 http status code if req.method is not GET or HEAD |
| setHeaders | function | null | signature function (res, path, stat) {}. path is the requested file path, the stat is the stat of the file if present, produced by mongodb fs.files, typically, it is { _id, length, chuckSize, uploadDate, md5, filename }, see uploadStream |
// with express js
import express from 'express'
import { MongoClient, GridFSBucket } from 'mongodb'
import serveGridfs from 'serve-gridfs'
const app = express()
const mongoConnection = MongoClient.connect('mongodb://localhost:27017/myApp')
app.use('/uploads', serveGridfs(mongoConnection))
app.use('/uploads_byname', serveGridfs(mongoConnection, { byId: false }))
const options = {
bucketName: 'somethingElse',
setHeaders(res, path, stat) {
if (stat && stat.contentType === 'application/pdf' && stat.length > 102400000) res.setHeader('Content-Disposition', 'attachment; filename = ' + path)
}
}
app.use('/uploads2', serveGridfs(mongoConnection, { bucketName: 'somethingElse' }))
Retriving a file
# Assuming there is a file with an _id of 001 and a filename of cat.png in mongodb gridfs collection, the following commands will retrieve the same file
$ curl http://localhost:3000/uploads/001
$ curl http://localhost:3000/uploads_byname/cat.png
cat/001 or cat/tom.png as an _id and filename respectively. In this case, curl http://localhost:3000/uploads/cat/001 and curl http://localhost:3000/uploads_byname/cat/tom.png will resolve to the same file.FAQs
serve files with mongodb grdifs
We found that serve-gridfs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.