mirror of
https://github.com/expressjs/expressjs.com.git
synced 2026-02-21 19:41:33 +00:00
Feat : Add Table of Contents Component on pages (#1775)
Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>
This commit is contained in:
shubham oulkar
@@ -6,11 +6,8 @@ menu: advanced
|
||||
lang: en
|
||||
redirect_from: "/advanced/best-practice-performance.html"
|
||||
---
|
||||
|
||||
# Production best practices: performance and reliability
|
||||
|
||||
## Overview
|
||||
|
||||
This article discusses performance and reliability best practices for Express applications deployed to production.
|
||||
|
||||
This topic clearly falls into the "devops" world, spanning both traditional development and operations. Accordingly, the information is divided into two parts:
|
||||
@@ -312,3 +309,5 @@ With load balancing, you might have to ensure that requests that are associated
|
||||
A reverse proxy sits in front of a web app and performs supporting operations on the requests, apart from directing requests to the app. It can handle error pages, compression, caching, serving files, and load balancing among other things.
|
||||
|
||||
Handing over tasks that do not require knowledge of application state to a reverse proxy frees up Express to perform specialized application tasks. For this reason, it is recommended to run Express behind a reverse proxy like [Nginx](https://www.nginx.org/) or [HAProxy](https://www.haproxy.org/) in production.
|
||||
|
||||
Handing over tasks that do not require knowledge of application state to a reverse proxy frees up Express to perform specialized application tasks. For this reason, it is recommended to run Express behind a reverse proxy like [Nginx](https://www.nginx.com/) or [HAProxy](http://www.haproxy.org/) in production.
|
||||
|
||||
@@ -21,19 +21,21 @@ Development and production environments are usually set up differently and have
|
||||
|
||||
Security best practices for Express applications in production include:
|
||||
|
||||
- [Don’t use deprecated or vulnerable versions of Express](#dont-use-deprecated-or-vulnerable-versions-of-express)
|
||||
- [Use TLS](#use-tls)
|
||||
- [Do not trust user input](#do-not-trust-user-input)
|
||||
- [Prevent open redirects](#prevent-open-redirects)
|
||||
- [Use Helmet](#use-helmet)
|
||||
- [Reduce fingerprinting](#reduce-fingerprinting)
|
||||
- [Use cookies securely](#use-cookies-securely)
|
||||
- [Don't use the default session cookie name](#dont-use-the-default-session-cookie-name)
|
||||
- [Set cookie security options](#set-cookie-security-options)
|
||||
- [Prevent brute-force attacks against authorization](#prevent-brute-force-attacks-against-authorization)
|
||||
- [Ensure your dependencies are secure](#ensure-your-dependencies-are-secure)
|
||||
- [Avoid other known vulnerabilities](#avoid-other-known-vulnerabilities)
|
||||
- [Additional considerations](#additional-considerations)
|
||||
- [Production Best Practices: Security](#production-best-practices-security)
|
||||
- [Overview](#overview)
|
||||
- [Don't use deprecated or vulnerable versions of Express](#dont-use-deprecated-or-vulnerable-versions-of-express)
|
||||
- [Use TLS](#use-tls)
|
||||
- [Do not trust user input](#do-not-trust-user-input)
|
||||
- [Prevent open redirects](#prevent-open-redirects)
|
||||
- [Use Helmet](#use-helmet)
|
||||
- [Reduce fingerprinting](#reduce-fingerprinting)
|
||||
- [Use cookies securely](#use-cookies-securely)
|
||||
- [Don't use the default session cookie name](#dont-use-the-default-session-cookie-name)
|
||||
- [Set cookie security options](#set-cookie-security-options)
|
||||
- [Prevent brute-force attacks against authorization](#prevent-brute-force-attacks-against-authorization)
|
||||
- [Ensure your dependencies are secure](#ensure-your-dependencies-are-secure)
|
||||
- [Avoid other known vulnerabilities](#avoid-other-known-vulnerabilities)
|
||||
- [Additional considerations](#additional-considerations)
|
||||
|
||||
## Don't use deprecated or vulnerable versions of Express
|
||||
|
||||
@@ -266,4 +268,4 @@ Here are some further recommendations from the excellent [Node.js Security Check
|
||||
* Use the [nmap](https://nmap.org/) and [sslyze](https://github.com/nabla-c0d3/sslyze) tools to test the configuration of your SSL ciphers, keys, and renegotiation as well as the validity of your certificate.
|
||||
* Use [safe-regex](https://www.npmjs.com/package/safe-regex) to ensure your regular expressions are not susceptible to [regular expression denial of service](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS) attacks.
|
||||
|
||||
[helmet]: https://helmetjs.github.io/
|
||||
[helmet]: https://helmetjs.github.io/
|
||||
@@ -42,4 +42,4 @@ app.get('/', (req, res) => {
|
||||
res.render('index', { title: 'Hey', message: 'Hello there!' })
|
||||
})
|
||||
```
|
||||
When you make a request to the home page, `index.ntl` will be rendered as HTML.
|
||||
When you make a request to the home page, `index.ntl` will be rendered as HTML.
|
||||
@@ -31,4 +31,4 @@ process.on('SIGTERM', () => {
|
||||
A load balancer uses health checks to determine if an application instance is healthy and can accept requests. For example, [Kubernetes has two health checks](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/):
|
||||
|
||||
* `liveness`, that determines when to restart a container.
|
||||
* `readiness`, that determines when a container is ready to start accepting traffic. When a pod is not ready, it is removed from the service load balancers.
|
||||
* `readiness`, that determines when a container is ready to start accepting traffic. When a pod is not ready, it is removed from the service load balancers.
|
||||
@@ -6,6 +6,7 @@ menu: advanced
|
||||
lang: en
|
||||
redirect_from: "/advanced/security-updates.html"
|
||||
---
|
||||
|
||||
# Security updates
|
||||
|
||||
<div class="doc-box doc-notice" markdown="1">
|
||||
@@ -64,4 +65,4 @@ The list below enumerates the Express vulnerabilities that were fixed in the spe
|
||||
* Sparse arrays that have extremely high indexes in query string could cause the process to run out of memory and crash the server.
|
||||
* Extremely nested query string objects could cause the process to block and make the server unresponsive temporarily.
|
||||
* 3.3.0
|
||||
* The 404 response of an unsupported method override attempt was susceptible to cross-site scripting attacks.
|
||||
* The 404 response of an unsupported method override attempt was susceptible to cross-site scripting attacks.
|
||||
@@ -8,15 +8,20 @@ redirect_from:
|
||||
- "en/changelog/4x.html"
|
||||
---
|
||||
|
||||
<div id="mw-container">
|
||||
<nav aria-label="sidebar-heading">
|
||||
<div class="toc-container">
|
||||
<h3 id="sidebar-heading" class="toc-heading"><em>Versions</em></h3>
|
||||
<button id="menu-toggle" title="show express versions">Versions <span>►</span></button>
|
||||
<ul id="menu">
|
||||
{% capture readme %}{% include changelog/menu.md %}{% endcapture %}
|
||||
<li>
|
||||
{{ readme | markdownify }}
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
</nav>
|
||||
|
||||
<div markdown="1" id="mw-list">
|
||||
|
||||
{% include changelog/menu.md %}
|
||||
|
||||
</div>
|
||||
|
||||
<div markdown="1" id="mw-content">
|
||||
<div markdown="1" id="page-doc">
|
||||
|
||||
# Release changelog
|
||||
|
||||
@@ -562,5 +567,3 @@ The 4.14.0 minor release includes bug fixes, security update, performance improv
|
||||
For a complete list of changes in this release, see [History.md](https://github.com/expressjs/express/blob/master/History.md#4140--2016-06-16).
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/behind-proxies.html"
|
||||
---
|
||||
|
||||
# Express behind proxies
|
||||
|
||||
When running an Express app behind a reverse proxy, some of the Express APIs may return different values than expected. In order to adjust for this, the `trust proxy` application setting may be used to expose information provided by the reverse proxy in the Express APIs. The most common issue is express APIs that expose the client's IP address may instead show an internal IP address of the reverse proxy.
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/database-integration.html"
|
||||
---
|
||||
|
||||
# Database integration
|
||||
|
||||
Adding the capability to connect databases to Express apps is just a matter of loading an appropriate Node.js driver for the database in your app. This document briefly explains how to add and use some of the most popular Node.js modules for database systems in your Express app:
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/debugging.html"
|
||||
---
|
||||
|
||||
# Debugging Express
|
||||
|
||||
To see all the internal logs used in Express, set the `DEBUG` environment variable to
|
||||
@@ -122,4 +123,3 @@ converted into an Options object that gets used with `%o`/`%O` formatters.
|
||||
See the Node.js documentation for
|
||||
[`util.inspect()`](https://nodejs.org/api/util.html#util_util_inspect_object_options)
|
||||
for the complete list." %}
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/error-handling.html"
|
||||
---
|
||||
|
||||
# Error Handling
|
||||
|
||||
_Error Handling_ refers to how Express catches and processes errors that
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/migrating-4.html"
|
||||
---
|
||||
|
||||
# Moving to Express 4
|
||||
|
||||
<h2 id="overview">Overview</h2>
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/migrating-5.html"
|
||||
---
|
||||
|
||||
# Moving to Express 5
|
||||
|
||||
<h2 id="overview">Overview</h2>
|
||||
|
||||
@@ -5,7 +5,6 @@ description: Discover how to customize and extend the Express.js API by overridi
|
||||
menu: guide
|
||||
lang: en
|
||||
---
|
||||
<div id="page-doc" markdown="1">
|
||||
|
||||
# Overriding the Express API
|
||||
|
||||
@@ -72,4 +71,3 @@ Unless necessary, it is recommended that this be done only at the application le
|
||||
Object.setPrototypeOf(Object.getPrototypeOf(app.request), FakeRequest.prototype)
|
||||
Object.setPrototypeOf(Object.getPrototypeOf(app.response), FakeResponse.prototype)
|
||||
```
|
||||
</div>
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/using-middleware.html"
|
||||
---
|
||||
|
||||
# Using middleware
|
||||
|
||||
Express is a routing and middleware web framework that has minimal functionality of its own: An Express application is essentially a series of middleware function calls.
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/using-template-engines.html"
|
||||
---
|
||||
|
||||
# Using template engines with Express
|
||||
|
||||
A _template engine_ enables you to use static template files in your application. At runtime, the template engine replaces
|
||||
@@ -63,4 +64,3 @@ app.get('/', (req, res) => {
|
||||
When you make a request to the home page, the `index.pug` file will be rendered as HTML.
|
||||
|
||||
The view engine cache does not cache the contents of the template's output, only the underlying template itself. The view is still re-rendered with every request even when the cache is on.
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@ menu: guide
|
||||
lang: en
|
||||
redirect_from: "/guide/writing-middleware.html"
|
||||
---
|
||||
|
||||
# Writing middleware for use in Express apps
|
||||
|
||||
<h2>Overview</h2>
|
||||
|
||||
@@ -91,4 +91,5 @@ Express is a project of the OpenJS Foundation. Please review the [trademark poli
|
||||
<img src="/images/brand/logo-dark.svg" alt="Express.js mark" width="96.5" height="56"/>
|
||||
</a>
|
||||
</div>
|
||||
<div>
|
||||
<div>
|
||||
</div>
|
||||
@@ -66,4 +66,4 @@ app.delete('/user', (req, res) => {
|
||||
|
||||
For more details about routing, see the [routing guide](/{{ page.lang }}/guide/routing.html).
|
||||
|
||||
### [Previous: Express application generator ](/{{ page.lang }}/starter/generator.html) [Next: Serving static files in Express ](/{{ page.lang }}/starter/static-files.html)
|
||||
### [Previous: Express application generator ](/{{ page.lang }}/starter/generator.html) [Next: Serving static files in Express ](/{{ page.lang }}/starter/static-files.html)
|
||||
@@ -51,4 +51,4 @@ $ npm install express --no-save
|
||||
By default with version npm 5.0+, `npm install` adds the module to the `dependencies` list in the `package.json` file; with earlier versions of npm, you must specify the `--save` option explicitly. Then, afterwards, running `npm install` in the app directory will automatically install modules in the dependencies list.
|
||||
</div>
|
||||
|
||||
### [Next: Hello World ](/{{ page.lang }}/starter/hello-world.html)
|
||||
### [Next: Hello World ](/{{ page.lang }}/starter/hello-world.html)
|
||||
Reference in New Issue
Block a user