diff --git a/en/4x/api.md b/en/4x/api.md index 54c63373..2e283375 100644 --- a/en/4x/api.md +++ b/en/4x/api.md @@ -10,7 +10,13 @@ redirect_from: "/4x/api.html"

4.x API

- {% include admonitions/note.html content="Express 4.0 requires Node.js 0.10 or higher." %} + {% capture node-version %} + + Express 4.0 requires Node.js 0.10 or higher. + + {% endcapture %} + + {% include admonitions/note.html content=node-version %} {% include api/en/4x/express.md %} {% include api/en/4x/app.md %} diff --git a/en/5x/api.md b/en/5x/api.md index 994f8afd..f5324ea3 100644 --- a/en/5x/api.md +++ b/en/5x/api.md @@ -10,7 +10,13 @@ redirect_from: "/5x/api.html"

5.x API

- {% include admonitions/note.html content="Express 5.0 requires Node.js 18 or higher." %} + {% capture node-version %} + + Express 5.0 requires Node.js 18 or higher. + + {% endcapture %} + + {% include admonitions/note.html content=node-version %} {% include api/en/5x/express.md %} {% include api/en/5x/app.md %} diff --git a/en/advanced/best-practice-security.md b/en/advanced/best-practice-security.md index cdd1e907..38350718 100644 --- a/en/advanced/best-practice-security.md +++ b/en/advanced/best-practice-security.md @@ -15,9 +15,14 @@ The term _"production"_ refers to the stage in the software lifecycle when an ap Development and production environments are usually set up differently and have vastly different requirements. What's fine in development may not be acceptable in production. For example, in a development environment you may want verbose logging of errors for debugging, while the same behavior can become a security concern in a production environment. And in development, you don't need to worry about scalability, reliability, and performance, while those concerns become critical in production. -{% include admonitions/note.html content="If you believe you have discovered a security vulnerability in Express, please see +{% capture security-note %} + +If you believe you have discovered a security vulnerability in Express, please see [Security Policies and Procedures](/en/resources/contributing.html#security-policies-and-procedures). -" %} + +{% endcapture %} + +{% include admonitions/note.html content=security-note %} Security best practices for Express applications in production include: @@ -132,10 +137,16 @@ disable using the `app.disable()` method: app.disable('x-powered-by') ``` -{% include admonitions/note.html content="Disabling the `X-Powered-By header` does not prevent +{% capture powered-advisory %} + +Disabling the `X-Powered-By header` does not prevent a sophisticated attacker from determining that an app is running Express. It may discourage a casual exploit, but there are other ways to determine an app is running -Express." %} +Express. + +{% endcapture %} + +{% include admonitions/note.html content=powered-advisory %} Express also sends its own formatted "404 Not Found" messages and formatter error response messages. These can be changed by diff --git a/en/changelog/index.md b/en/changelog/index.md index ea8108b6..1e222a64 100644 --- a/en/changelog/index.md +++ b/en/changelog/index.md @@ -565,7 +565,12 @@ The 4.14.0 minor release includes bug fixes, security update, performance improv
  • The [jshttp/cookie module](https://www.npmjs.com/package/cookie) (in addition to a number of other improvements) has been updated and now the [`res.cookie()` method](/{{ page.lang }}/4x/api.html#res.cookie) supports the `sameSite` option to let you specify the [SameSite cookie attribute](https://tools.ietf.org/html/draft-west-first-party-cookies-07). - {% include admonitions/note.html content="This attribute has not yet been fully standardized, may change in the future, and many clients may ignore it." %} + {% capture note-4-14-0 %} + + This attribute has not yet been fully standardized, may change in the future, and many clients may ignore it. + + {% endcapture %} + {% include admonitions/note.html content=note-4-14-0 %} The possible value for the `sameSite` option are: diff --git a/en/guide/debugging.md b/en/guide/debugging.md index d2d33597..98b2c680 100755 --- a/en/guide/debugging.md +++ b/en/guide/debugging.md @@ -118,8 +118,14 @@ When running through Node.js, you can set a few environment variables that will | `DEBUG_FD` | File descriptor to write debug output to. | | `DEBUG_SHOW_HIDDEN` | Shows hidden properties on inspected objects. | -{% include admonitions/note.html content="The environment variables beginning with `DEBUG_` end up being +{% capture debug-text %} + +The environment variables beginning with `DEBUG_` end up being converted into an Options object that gets used with `%o`/`%O` formatters. See the Node.js documentation for [`util.inspect()`](https://nodejs.org/api/util.html#util_util_inspect_object_options) -for the complete list." %} +for the complete list. + +{% endcapture %} + +{% include admonitions/note.html content=debug-text %} diff --git a/en/guide/routing.md b/en/guide/routing.md index 574ec2e4..f47ee17e 100755 --- a/en/guide/routing.md +++ b/en/guide/routing.md @@ -79,12 +79,20 @@ Route paths, in combination with a request method, define the endpoints at which {% include admonitions/caution.html content=note-dollar-character %} {% capture note-path-to-regexp %} - Express uses [path-to-regexp](https://www.npmjs.com/package/path-to-regexp) for matching the route paths; see the path-to-regexp documentation for all the possibilities in defining route paths. [Express Playground Router](https://bjohansebas.github.io/playground-router/) is a handy tool for testing basic Express routes, although it does not support pattern matching. + +Express uses [path-to-regexp](https://www.npmjs.com/package/path-to-regexp) for matching the route paths; see the path-to-regexp documentation for all the possibilities in defining route paths. [Express Playground Router](https://bjohansebas.github.io/playground-router/) is a handy tool for testing basic Express routes, although it does not support pattern matching. + {% endcapture %} {% include admonitions/note.html content=note-path-to-regexp %} -{% include admonitions/warning.html content="Query strings are not part of the route path." %} +{% capture query-string-note %} + +Query strings are not part of the route path. + +{% endcapture %} + +{% include admonitions/warning.html content=query-string-note %} ### Route paths based on strings @@ -217,10 +225,19 @@ Request URL: http://localhost:3000/user/42 req.params: {"userId": "42"} ``` -{% include admonitions/warning.html content="Because the regular expression is usually part of a literal string, be sure to escape any `\` characters with an additional backslash, for example `\\d+`." %} +{% capture escape-advisory %} + +Because the regular expression is usually part of a literal string, be sure to escape any `\` characters with an additional backslash, for example `\\d+`. + +{% endcapture %} + + +{% include admonitions/warning.html content=escape-advisory %} {% capture warning-version %} + In Express 4.x, the `*` character in regular expressions is not interpreted in the usual way. As a workaround, use `{0,}` instead of `*`. This will likely be fixed in Express 5. + {% endcapture %} {% include admonitions/warning.html content=warning-version %} diff --git a/en/guide/using-middleware.md b/en/guide/using-middleware.md index fdf8ecc1..97e9320e 100644 --- a/en/guide/using-middleware.md +++ b/en/guide/using-middleware.md @@ -100,7 +100,13 @@ app.get('/user/:id', (req, res, next) => { To skip the rest of the middleware functions from a router middleware stack, call `next('route')` to pass control to the next route. -{% include admonitions/note.html content="`next('route')` will work only in middleware functions that were loaded by using the `app.METHOD()` or `router.METHOD()` functions." %} +{% capture next-function %} + +`next('route')` will work only in middleware functions that were loaded by using the `app.METHOD()` or `router.METHOD()` functions. + +{% endcapture %} + +{% include admonitions/note.html content=next-function %} This example shows a middleware sub-stack that handles GET requests to the `/user/:id` path. diff --git a/en/resources/glossary.md b/en/resources/glossary.md index fe4c0444..72c759ad 100755 --- a/en/resources/glossary.md +++ b/en/resources/glossary.md @@ -41,7 +41,13 @@ A software platform that is used to build scalable network applications. Node.js When used as an adjective, hyphenate; for example: "This is open-source software." See [Open-source software on Wikipedia](http://en.wikipedia.org/wiki/Open-source_software). -{% include admonitions/note.html content="Although it is common not to hyphenate this term, we are using the standard English rules for hyphenating a compound adjective." %} +{% capture english-rules %} + +Although it is common not to hyphenate this term, we are using the standard English rules for hyphenating a compound adjective. + +{% endcapture %} + +{% include admonitions/note.html content=english-rules %} ### request