travelling
Advanced tools
Travelling
A blazing fast dynamic route level groups/permissions api gateway.
Download the latest release or run git clone https://github.com/abeai/travelling.git
Inside the root Travelling folder run: npm install
Set the TRAVELLING_DATABASE_URL environment variable which needs to be pointing to a new PostgreSQL database to start. Do this by creating a .env file inside the root Travelling folder. For example:
TRAVELLING_DATABASE_URL=postgres://postgres@localhost/travelling
Set the salts and secrets for the following:
## Cookie Session Settings
TRAVELLING_COOKIE_SESSION_SECRET=Yzy)8EbJOUJf+~e^%#7-lo1)RJUs.UVPBu4d3qqd0ZDQ!A~ti%Sq<kPy)nfVSn0;TRBeD0_QeMxKzp]Yn{hQe4j#ZtQ{L$0O>+hBJl^-%TKX<S>u|~xz;hFS(DO32tw#
## Cookie Token Settings
TRAVELLING_COOKIE_TOKEN_SECRET=qVsI_O|Y0VPz>xvW-Uu!&5lejE3M4w-l0KvCI!v4q|9|F0W+v9g-hb!*yX8*3O%Ty@4$~:@1!VX*?Sl&c}KW&a4..gceGHg)KoiVpc9-8bCnrmG&&}iI;7VY+-+&U(?:
TRAVELLING_COOKIE_TOKEN_SALT=?)WJ.$!570)5[@bDNip!q.t1J#/B.fJ{cyC--Zd/IJwJ/~L+(&#XOz|FuIoc{k;@8wf#gOrn||Ng1+2bDxOuQ6$_6QK{aWUfc-PZ{L62(0JRKizR~Y*/K8YT]?gLHB+S
## Postgres Crypto Settings
TRAVELLING_PG_CRYPTO_IMPLEMENTATION_SECRET=:Y@K$;nE8r~D]dR-#%<PyI]/]^v&#lIz7T(OHrI@sAA_Y/+C%bYVfoY5(r#3IN6tC_fn9vpy%CKXh?K0k:<M/[PXs*r2CO~:]!2qBmB,9}RW)8i$$P#uFt_>u,v_M9K}
TRAVELLING_PG_CRYPTO_IMPLEMENTATION_SALT=Wdwrmww~NxDAFn2/@~1SfV6&Iq7/PR;]k2Me*gK*(|I!sxcr/V,_0Bbys25dIF!sm,}XG)%U!(9|3gS4Hy1Hjo}D.WsF{!6|+x,t{O6T^S):kuglmBokNNqQeHL^bWk%
These are example secrets and salts DO NOT USE THESE VALUES generate your own. You can use the included script via ./scripts/generateRandom.sh to generate a 128 character random string to use for salts and secrets. See Security for more details on keeping Travelling secure.
See Configuration for all other configurable options.
It is recommended to follow this security tips to help keep Travelling as secure as possible.
Configuration is done through environment variables. All variables have a default values except for what is stated in Minimum New Setup
Travelling's serving port.
Default:
443
Travelling's serving IP.
Default:
0.0.0.0
The path to the SSL key that is used for https
Default:
travelling/localhost.key
The path to the SSL cert that is used for https
Default:
travelling/localhost.csr
Enables https serving.
Default:
travelling/localhost.csr
Recommended to keep this disabled due to security reasons. Only enable this if you really need it and know the risks.
Allows external services to make api calls to Travelling.
Default:
false
Full host path or wildstar * host pathed subdomains to allow. This is returned back with all requests.
Default: Rewrites the origin to whatever external host is making the call. This allows all external calls allowed and is not recommended.
Example:*.domain.com
access-control-allow-methods header that is returned back with all requests.
Default: Rewrites it's self to the
access-control-request-methodheader request or sets to*if there is no request.
Example:GET,DELETE
access-control-allow-credentials header that is returned back with all routes under /travelling/api/v1/auth/
Default:
true
access-control-max-age header that is returned back with all CORS options request.
Default:
3600
For maximum performance it is recommended to disable TRAVELLING_LOG_FASTIFY_LOGGER_REQUEST and TRAVELLING_LOG_FASTIFY_LOGGER
Enables TRAVELLING_LOG_LOGGER.
Default:
true
An absolute file path to a custom node.js logger. This must not be set for the settings TRAVELLING_LOG_LEVEL & TRAVELLING_LOG_COLORS to function. It also needs to support the same interface as Node's built in console logger.
Default:
travelling/include/utils/logger.js
Enables console colors to be used with TRAVELLING_LOG_LOGGER.
Default:
true
Sets the log level for TRAVELLING_LOG_LOGGER. The options are trace,debug,info,warn,error,fatal.
Default:
info
Enables logging of every request of all requests with TRAVELLING_LOG_LOGGER.
Default:
true
Enables logging of every unauthorized access requests made with TRAVELLING_LOG_LOGGER.
Default:
true
Enables logging for fastify's built-in pino logger. This can be set to a true/false value or a absolute path of a javascript file to set pino's settings / implement a custom logger from the pino interface.
Default:
false
Example: js file setting pino settings.
module.exports = {
level: 'info'
}
Enables logging of every request and response in pino's format. Recommended not to have this and TRAVELLING_LOG_LOGGER enabled at once
Default:
true
The name of the header that gets set by pino's correlation id system.
Default:
travelling-req-id
The name of the property that gets set by pino's correlation id system.
Default:
travellingReqID
Enables the portal which has the client for login/logout/register/forgotPassword/oauth2Code functionality. This should always be enabled.
Default:
true
The route that travelling will serve the client at.
Default:
/travelling/portal/
This is used once on the first startup of Travelling during group initialization. This sets the remote host of a custom client to be served under the TRAVELLING_PORTAL_HOST path.
Default:
travelling/localhost.key
The absolute filepath to the root directory of the client files. Recommended not to be changed unless unless there is a need for a fully custom rewrite of Travelling's client pages.
Default:
travelling/client/dist
The absolute filepath to the logo to be displayed on the client side.
Default:
travelling/client/assets/logo.svg
The absolute filepath to the css file to be displayed on the client side.
Default:
travelling/client/assets/styles.css
The absolute filepath to the faveicon to be displayed on the client side.
Default:
travelling/client/assets/favicon.ico
How long in seconds the proxy should wait on a request to finish. 0 is Infinity
Default:
0
Allows Travelling to send permission/user/group based headers along with the proxy route
Default:
false
| Header | Description |
|---|---|
un | User's Username. |
uid | User's Id. |
gn | User's Group's name that allowed the request. |
gt | User's Group's type that allowed the request. |
perm | Permission's name that allowed the request. |
Enables redis to be used when multiple instances of travelling are running and being load balanced against.
Default:
falseUses in memory store which could be problematic depending on how many groups and routes there are.
The URL to a redis instance to be used by travelling as a data store.
Default:
redis://127.0.0.1:6379/
The URL to a redis instance to be used by travelling as a pub/sub event system.
Default:
redis://127.0.0.1:6379/
Travelling uses a dual cookie system. One is a persistent token cookie for longterm login and the other is a short lived session cookie made to put less load on the system and speed things up making it not need to decrypt the token cookie every request.
The session secret used to generate the session cookie with. This needs to stay a secret and should be changed ever so often for security reasons
Default:
This needs to be set!
How long the session cookie will last for in seconds. Recommended to set it to the average number of seconds a user tends to use your service for.
Default:
300
The token secret used to generate the persistent token cookie with. This needs to stay a secret and should be changed ever so often for security reasons
Default:
nullThis needs to be set!
The token salt used to generate the persistent token cookie with. This needs to stay a secret and should be changed ever so often for security reasons
Default:
nullThis needs to be set!
How long the persistent token cookie will last for in days.
Default:
30
How long the persistent token cookie will last for in days.
Default:
null
Enables cookie linked to remote ip's. Disabling this removes one more layer of protection against CRSF attacks, but might be needed depending on your Cors settings.
Default:
true
This allows users that have same username/email to register and be isolated by the domain property. This is useful if you have multiple websites and you want to keep your users isolated from each other.
Default:
false
The minimum amount of characters a username has to have.
Default:
4
Require users to have usernames
Default:
true
Disables user's passwords from having any consecutive characters.
Default:
false
The minimum amount of characters a user's password has to have
Default:
8
The maximum amount of characters a user's password is allowed to have. Leaving this unset makes it unlimited
Default:
The minimum amount of special characters a user's password has to have.
Default:
30
The minimum amount of numbers characters a user's password has to have.
Default:
1
The minimum amount of lowercase characters a user's password has to have.
Default:
1
The minimum amount of uppercase characters a user's password has to have.
Default:
1
The maximum amount of failed login attempts until a user is locked.
Default:
10
How long a OAUTH2 Access token will last for in minutes.
Default:
1440
How long a OAUTH2 Code token will last for in minutes.
Default:
5
Enforces the user to click a authorize button to allow a client to login for the user.
Default:
true
The Postgres connection url for Travelling to connect to.
Default:
nullThis needs to be set!
The absolute path to the encryption interface that is used for Travelling's database encryption fields. If a custom implementation is wanted please check out travelling/include/utils/cryptointerface.js for methods needed to be functional.
Default:
travelling/include/utils/cryptointerface.js
The secret used inside TRAVELLING_PG_CRYPTO_IMPLEMENTATION. This needs to stay a secret and should be changed ever so often for security reasons.
Default:
nullThis needs to be set!
The salt used inside TRAVELLING_PG_CRYPTO_IMPLEMENTATION. This needs to stay a secret and should be changed ever so often for security reasons.
Default:
nullThis needs to be set!
Enables the user_data field inside the user object to be encrypted. If sensitive data is stored in within that field it is recommended to enable this.
Default:
false
The email that will be used as the from address. Recommended to set it to a no-reply email address
Default:
null
The number of seconds for the email recovery link to last for. Recommended to keep this somewhat short-lived for security reasons.
Default:
900
The number of seconds for the email activation link to last for.
Default:
86400
Enables the use of a test email service that will display the login credentials inside the log at start. This is used by our integration test. However, it is helpful to enable this if custom Templates are written. Only one type of email support should be used Test, SMTP or AWS.
Default:
false
Enables the use of a SMTP email service. Only one type of email support should be used Test, SMTP or AWS.
Default:
false
The host of the SMTP service.
Default:
127.0.0.1
The port of the SMTP service.
Default:
465
Enables TLS for SMTP.
Default:
true
Username for SMTP service.
Default:
null
Password for SMTP service.
Default:
null
Enables rejection of TLS certs that are self served or invalid. Recommended to keep it enabled for security reasons.
Default:
true
Enables the use of the AWS SES email service. Only one type of email support should be used Test, SMTP or AWS.
Default:
false
The absolute path to the AWS json credentials config to use for accessing the SES service. See AWS's configuration documentation on the format of this file.
Default:
null// This needs to be set to use AWS SES email service.
Templates all use html/handlebars. Check out the example default templates inside the travelling/templates/ folder for examples.
Reset Template Variables:
| Variable | Description |
|---|---|
{{user}} | This is the user object for the reset email. Use dot notation to access any of its properties for example: {{user.username}}. |
{{config}} | This is the config object for Travelling. Use dot notation to access any of its properties for example {{config.port}}. |
{{token}} | The reset token that Travelling needs to reset the password. Recommended to just copy and paste the full a href from the TRAVELLING_EMAIL_RESET_PASSWORD_TEMPLATE_BODY. |
{{ip}} | This is the IP object from the user requesting the reset password. The following properties are valid. query,city, regionName, country. |
Activation Template Variables:
| Variable | Description |
|---|---|
{{user}} | This is the user object for the activation email. Use dot notation to access any of its properties for example: {{user.username}}. |
{{config}} | This is the config object for Travelling. Use dot notation to access any of its properties for example {{config.port}}. |
{{token}} | The reset token that Travelling needs to activate the user's account. Recommended to just copy and paste the full a href from the TRAVELLING_EMAIL_ACTIVATION_TEMPLATE_BODY. |
The absolute path to the email reset password template body. This is used as the body inside all reset password emails.
Default:
travelling/templates/email-reset-password-body.html
The absolute path to the email reset password template subject. This is used as the subject line inside all reset password emails.
Default:
templates/email-reset-password-subject.html
The absolute path to the email activation template body. This is used as the body inside all activation emails.
Default:
templates/email-activation-body.html
The absolute path to the email activation template subject.This is used as the subject line inside all activation emails.
Default:
templates/email-activation-subject.html
Enables the requirement of each newly registered user to activate their account through the email link.
Default:
false
Enables the requirement of each newly registered user to have a active user with permissions to unlock their account for them.
Default:
false
v1.0.0
12 February 2021
#4#5#3#2#174f90012ded3c7e8c8f602717223324dc9d050f6af5a9e64c775ed7ffa9d8f44e08024d705b9784cc11e474b788cec0448d4ce2d82ff033c87cccf8486d2ad1f71307c53401f20c1673191e709f4ba5fed36cef2681dbcd195f9717ab46f9f6e18bca5dbbc67a73d5c468851aeb4806a19d02a88489fad83c2214cf5b28crfc6749#section-10.6 and some cleanup 8f96cec0e41b3a567ac30ab100f0efa3e1347b7f2af1f0383ba84e61f6cf3a3899609dbcf6be03e0a09de68ed8275baa97da4ddd6b02b9d8ec2e9a4c25b8a2761d12b8c229d04e91cbacd26e30a2b2306037e7ec318813091a1e6bc93330d415d2dbbc3363a1161b57eef0724969aa85f09403f5cfc76683de3fd565eb2d47a254f05eea6eb3592c62e1b949e2f3b07FAQs
A dynamic route level groups permissions middleman service
The npm package travelling receives a total of 0 weekly downloads. As such, travelling popularity was classified as not popular.
We found that travelling demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.