Thursday, September 17, 2015

Improving Security in Node.js



A collection of tips and ideas to improve the security of a Node.js application.

Don't let your app identify itself as a Node.js application

In the response header you might have:
X-Powered-By: Express
Set-Cookie: connect.sid: sJbhAJcKt1JVuCRZ5HwpYMhFBAKaXm0

The first item identifies that your application is using Express.js which identifies Node. The second in a similar manner identifies the Connect middleware for session management, again a Node module.

The fixes for these are very simple. To suppress the X-Powered-By header key/value you should do this:

app = express();
app.disable('x-powered-by');


For the connect.sid identifier you can change the default name by using the "key" key in the initialization object:

app.use(session({
  key: '<customize me>',
  ...



Wednesday, September 16, 2015

No Website Needed


I have a friend who's an architect. He does bespoke designs for shops and houses. He's never had a website and he says that's one of his unique-selling-points (USP) when talking to a customer.

Apparently the conversation goes something like this:

Customer: "I searched the web and I couldn't find your website or anything else about you."
Architect: "The only reason that we're talking now is because someone, probably an existing client, recommended me to you. I only do work through referrals and I find that I have more work than I can cope with."

In his response he's implying that he's that good that he doesn't have to advertise. According to him that's a very powerful sales pitch during the initial consultation with a future client. A website, he feels, would not allow him to use that line in closing a sale.

Tuesday, September 15, 2015

Moving your Team and Project to ES6

How do you safely move your team to using ES6?



1. Convince the team/boss/stakeholders that it's time to move to ES6


The points in this article might help.

2. Decide what you're going to use


Are you going to use a transpiler like Babel or a shim? If using Node.js are you going to use the --harmony flag? There are plenty of articles that discuss this.

3. Start using ES6


Most teams will have at least one person who wants to use the new syntax. This is how these developers should introduce ES6 to the rest of the team.

Training? That's one way. Another is to cross-train each other on a code base that you're already working on.

Let's say that you wrote some ES5 code like this:

handleChange(name, e) {
  var change = {};
  change[name] = e.target.value;
  this.setState(change);
}

and you decided that you'd rather use ES6 syntax like this:

handleChange(name, e) {
  var change = {
    [name]: e.target.value;
  }
  this.setState(change);
}

The better way to use the ES6 syntax is to tag it with the name of the new feature like this:

handleChange(name, e) {
  var change = {
    // ES6: Destructuring, computed property keys
    [name]: e.target.value;
  }
  this.setState(change);
}

A developer looking at the ES6 comment should be able to copy/paste the text into a search engine and find a reasonable list of articles that deal with the feature.

4. Teach in the Pull Request Review


Now when you do a Pull Request on your changes message the rest of the team that there are labeled ES6 features.

I've found that this has the extra bonus of having more developers want to review your code because they know that they're going to be learning something new about ES6 during the review process.

Your team are already contributing to and editing a code-base that they're familiar with so the ES6 usage that they're learning is not contrived. It's real world.

5. Remove the ES6 comments


The comments labeled ES6: are there for training purposes. After a period of time you may want to remove them. This is easy to do in a search and delete of this type of comment in the code base.

If you have a lot of non-ES6 developers continually joining the project then you might not want to do this. You can also tag the repository before removing the comments so others can checkout that tag and read the comments.

You might also elect to start dropping comments for the easy-to-understand and common ES6 features and keep them in for the more complex scenarios.

Wednesday, March 25, 2015

Should I use Extend or Assign in Lodash?

 

 

Use _.assign()


Justification

 

  1. If you look at the lodash documentation for _.assign() you'll see that _.extend() is an alias for _.assign(), not the other way around. This would imply that _.assign() is the default and _.extend() is an alternative.
  2. ECMAScript 6 will use assign() and not extend().

Friday, November 28, 2014

How does a covering index on a database work?

Today I was having a conversation with a co-worker who lives in Italy. He said that Christmas in Italy starts on December 8 which is a holiday in Italy but he didn't know the English name for the holiday.

I went to Google and typed in "december 8 holiday italy" and got back this result:


I didn't need to  click on the result of the first (or any) item that turned up in the search result because all the information that I needed was right there: The Feast of the Immaculate Conception.

This is a covering index. When the results from the index alone can satisfy the information that you seek then they are said to be "covered in the index" and no further lookup is required.

In my search analogy I only made one request to the Google index and never opened the page that it pointed to.

In a database I would pull back all the information that I needed from the table's index and not have to retrieve the record from the table to complete the information search.

Leaving the land of Google analogy you might have a table with an index on userId. Finding that ID in the index allows the database to quickly locate the record in the table from which it can pull the name, for example.

If you had an index on both userId and userName then only the index would need to be searched if all you are after is userName and the second lookup in the table would not be needed.

Thursday, October 23, 2014

Retro Forking with Git and GitHub

Problem: You cloned a repository that you don't have write access to and you've done some work on it. Now you want to commit that work and push it to GitHub but you never did a fork.

1. Fork the repository, for my example I'm using https://github.com/rjrodger/seneca-mvp

2. In the console in the local repository folder do "git remote -v" to find out what the remote address is:

$ git remote -v
origin    git@github.com:rjrodger/seneca-mvp.git (fetch)
origin    git@github.com:rjrodger/seneca-mvp.git (push)

3. Add this repository as the upstream repository with "git remote add":

git remote add upstream https://github.com/rjrodger/seneca-mvp

4. "git remote -v" should now show:

$ git remote -v
origin    git@github.com:rjrodger/seneca-mvp.git (fetch)
origin    git@github.com:rjrodger/seneca-mvp.git (push)
upstream    https://github.com/rjrodger/seneca-mvp (fetch)
upstream    https://github.com/rjrodger/seneca-mvp (push)


5. Change the origin to your fork:

git remote set-url origin git@github.com:guyellis/seneca-mvp.git

6. Confirm the change:

$ git remote -v
origin    git@github.com:guyellis/seneca-mvp.git (fetch)
origin    git@github.com:guyellis/seneca-mvp.git (push)
upstream    https://github.com/rjrodger/seneca-mvp (fetch)
upstream    https://github.com/rjrodger/seneca-mvp (push)