@reldens/server-utils 0.36.0 → 0.38.0

package/index.js

@@ -8,10 +8,18 @@ const { FileHandler } = require('./lib/file-handler');
 const { AppServerFactory } = require('./lib/app-server-factory');
 const { UploaderFactory } = require('./lib/uploader-factory');
 const { Encryptor } = require('./lib/encryptor');
+const { Http2CdnServer } = require('./lib/http2-cdn-server');
+const { ServerDefaultConfigurations } = require('./lib/server-default-configurations');
+const { ServerFactoryUtils } = require('./lib/server-factory-utils');
+const { ServerHeaders } = require('./lib/server-headers');
 
 module.exports = {
     FileHandler,
     AppServerFactory,
     UploaderFactory,
-    Encryptor
+    Encryptor,
+    Http2CdnServer,
+    ServerDefaultConfigurations,
+    ServerFactoryUtils,
+    ServerHeaders
 };

package/lib/app-server-factory/reverse-proxy-configurer.js

@@ -0,0 +1,132 @@
+/**
+ *
+ * Reldens - ReverseProxyConfigurer
+ *
+ */
+
+const { createProxyMiddleware } = require('http-proxy-middleware');
+const { ServerHeaders } = require('../server-headers');
+
+class ReverseProxyConfigurer
+{
+
+    constructor()
+    {
+        this.isDevelopmentMode = false;
+        this.useVirtualHosts = false;
+        this.reverseProxyRules = [];
+        this.reverseProxyOptions = {
+            changeOrigin: true,
+            ws: true,
+            secure: false,
+            logLevel: 'warn'
+        };
+        this.serverHeaders = new ServerHeaders();
+    }
+
+    setup(app, config)
+    {
+        this.isDevelopmentMode = config.isDevelopmentMode || false;
+        this.useVirtualHosts = config.useVirtualHosts || false;
+        this.reverseProxyRules = config.reverseProxyRules || [];
+        this.reverseProxyOptions = config.reverseProxyOptions || this.reverseProxyOptions;
+        if(0 === this.reverseProxyRules.length){
+            return;
+        }
+        this.applyRules(app);
+    }
+
+    applyRules(app)
+    {
+        for(let rule of this.reverseProxyRules){
+            if(!this.validateProxyRule(rule)){
+                continue;
+            }
+            let proxyMiddleware = this.createProxyMiddleware(rule);
+            if(!proxyMiddleware){
+                continue;
+            }
+            let pathPrefix = rule.pathPrefix || '/';
+            if(this.useVirtualHosts){
+                app.use(pathPrefix, (req, res, next) => {
+                    let hostname = this.extractHostname(req);
+                    if(hostname !== rule.hostname){
+                        return next();
+                    }
+                    return proxyMiddleware(req, res, next);
+                });
+                continue;
+            }
+            app.use(pathPrefix, proxyMiddleware);
+        }
+    }
+
+    extractHostname(req)
+    {
+        if(req.domain && req.domain.hostname){
+            return req.domain.hostname;
+        }
+        let host = req.get('host') || '';
+        return host.split(':')[0].toLowerCase();
+    }
+
+    validateProxyRule(rule)
+    {
+        if(!rule){
+            return false;
+        }
+        if(!rule.hostname){
+            return false;
+        }
+        if(!rule.target){
+            return false;
+        }
+        return true;
+    }
+
+    createProxyMiddleware(rule)
+    {
+        let options = Object.assign({}, this.reverseProxyOptions);
+        if('boolean' === typeof rule.changeOrigin){
+            options.changeOrigin = rule.changeOrigin;
+        }
+        if('boolean' === typeof rule.websocket){
+            options.ws = rule.websocket;
+        }
+        if('boolean' === typeof rule.secure){
+            options.secure = rule.secure;
+        }
+        if('string' === typeof rule.logLevel){
+            options.logLevel = rule.logLevel;
+        }
+        options.target = rule.target;
+        options.onError = this.handleProxyError.bind(this);
+        options.onProxyReq = (proxyReq, req) => {
+            if(req.headers['x-forwarded-for']){
+                return;
+            }
+            let clientIp = req.ip || req.connection.remoteAddress || '';
+            proxyReq.setHeader(this.serverHeaders.proxyForwardedFor, clientIp);
+            proxyReq.setHeader(this.serverHeaders.proxyForwardedProto, req.protocol);
+            proxyReq.setHeader(this.serverHeaders.proxyForwardedHost, req.get('host') || '');
+        };
+        return createProxyMiddleware(options);
+    }
+
+    handleProxyError(err, req, res)
+    {
+        if(res.headersSent){
+            return;
+        }
+        if('ECONNREFUSED' === err.code){
+            return res.status(502).send('Bad Gateway - Backend server unavailable');
+        }
+        if('ETIMEDOUT' === err.code || 'ESOCKETTIMEDOUT' === err.code){
+            return res.status(504).send('Gateway Timeout');
+        }
+        return res.status(500).send('Proxy Error');
+    }
+
+}
+
+module.exports.ReverseProxyConfigurer = ReverseProxyConfigurer;

package/lib/app-server-factory/security-configurer.js

@@ -16,38 +16,36 @@ class SecurityConfigurer
         this.useHelmet = true;
         this.useXssProtection = true;
         this.helmetConfig = false;
+        this.helmetOptions = {};
         this.sanitizeOptions = {allowedTags: [], allowedAttributes: {}};
     }
 
     setupHelmet(app, config)
     {
-        this.isDevelopmentMode = config.isDevelopmentMode || false;
         this.useHelmet = config.useHelmet !== false;
-        this.helmetConfig = config.helmetConfig || false;
         if(!this.useHelmet){
             return;
         }
-        let helmetOptions = this.setModeOptions({
+        app.use(helmet(this.mapHelmetOptions(config)));
+    }
+
+    mapHelmetOptions(config)
+    {
+        this.isDevelopmentMode = config.isDevelopmentMode || false;
+        this.helmetConfig = config.helmetConfig || {};
+        this.helmetOptions = {
             crossOriginEmbedderPolicy: false,
             crossOriginOpenerPolicy: false,
             crossOriginResourcePolicy: false,
             originAgentCluster: false
-        }, config);
-        if(this.helmetConfig){
-            Object.assign(helmetOptions, this.helmetConfig);
-        }
-        app.use(helmet(helmetOptions));
-    }
-
-    setModeOptions(helmetOptions, config)
-    {
+        };
         if(this.isDevelopmentMode){
-            helmetOptions.contentSecurityPolicy = false;
-            helmetOptions.hsts = false;
-            helmetOptions.noSniff = false;
-            return helmetOptions;
+            this.helmetOptions.contentSecurityPolicy = false;
+            this.helmetOptions.hsts = false;
+            this.helmetOptions.noSniff = false;
+            return this.helmetOptions;
         }
-        helmetOptions.contentSecurityPolicy = {
+        this.helmetOptions.contentSecurityPolicy = {
             directives: {
                 defaultSrc: ["'self'"],
                 scriptSrc: ["'self'"],
@@ -62,13 +60,50 @@ class SecurityConfigurer
                 formAction: ["'self'"]
             }
         };
+        if(this.helmetConfig.contentSecurityPolicy){
+            if(this.helmetConfig.contentSecurityPolicy.overrideDirectives){
+                this.helmetOptions.contentSecurityPolicy.directives = this.helmetConfig.contentSecurityPolicy.directives;
+            }
+            if(
+                !this.helmetConfig.contentSecurityPolicy.overrideDirectives
+                && this.helmetConfig.contentSecurityPolicy.directives
+            ){
+                let configDirectivesKeys = Object.keys(this.helmetConfig.contentSecurityPolicy.directives);
+                for(let directiveKey of configDirectivesKeys){
+                    let directiveValues = this.helmetConfig.contentSecurityPolicy.directives[directiveKey];
+                    if(!Array.isArray(directiveValues)){
+                        continue;
+                    }
+                    if(!this.helmetOptions.contentSecurityPolicy.directives[directiveKey]){
+                        this.helmetOptions.contentSecurityPolicy.directives[directiveKey] = [];
+                    }
+                    for(let value of directiveValues){
+                        this.helmetOptions.contentSecurityPolicy.directives[directiveKey].push(value);
+                    }
+                }
+            }
+            let cspKeys = Object.keys(this.helmetConfig.contentSecurityPolicy);
+            for(let cspKey of cspKeys){
+                if('directives' === cspKey || 'overrideDirectives' === cspKey){
+                    continue;
+                }
+                this.helmetOptions.contentSecurityPolicy[cspKey] = this.helmetConfig.contentSecurityPolicy[cspKey];
+            }
+        }
+        let helmetConfigKeys = Object.keys(this.helmetConfig);
+        for(let configKey of helmetConfigKeys){
+            if('contentSecurityPolicy' === configKey){
+                continue;
+            }
+            this.helmetOptions[configKey] = this.helmetConfig[configKey];
+        }
         if(config.developmentExternalDomains){
             this.addExternalDomainsToCsp(
-                helmetOptions.contentSecurityPolicy.directives,
+                this.helmetOptions.contentSecurityPolicy.directives,
                 config.developmentExternalDomains
             );
         }
-        return helmetOptions;
+        return this.helmetOptions;
     }
 
     addExternalDomainsToCsp(directives, externalDomains)
@@ -79,11 +114,12 @@ class SecurityConfigurer
             if(!Array.isArray(domains)){
                 continue;
             }
+            let camelCaseKey = directiveKey.replace(/-([a-z])/g, (match, letter) => letter.toUpperCase());
             for(let domain of domains){
-                if(directives[directiveKey]){
-                    directives[directiveKey].push(domain);
+                if(directives[camelCaseKey]){
+                    directives[camelCaseKey].push(domain);
                 }
-                let elemKey = directiveKey.replace('-src', '-src-elem');
+                let elemKey = camelCaseKey+'Elem';
                 if(directives[elemKey]){
                     directives[elemKey].push(domain);
                 }

package/lib/app-server-factory.js

@@ -5,10 +5,15 @@
  */
 
 const { FileHandler } = require('./file-handler');
+const { Http2CdnServer } = require('./http2-cdn-server');
+const { ServerDefaultConfigurations } = require('./server-default-configurations');
+const { ServerFactoryUtils } = require('./server-factory-utils');
+const { ServerHeaders } = require('./server-headers');
 const { DevelopmentModeDetector } = require('./app-server-factory/development-mode-detector');
 const { ProtocolEnforcer } = require('./app-server-factory/protocol-enforcer');
 const { SecurityConfigurer } = require('./app-server-factory/security-configurer');
 const { CorsConfigurer } = require('./app-server-factory/cors-configurer');
+const { ReverseProxyConfigurer } = require('./app-server-factory/reverse-proxy-configurer');
 const { RateLimitConfigurer } = require('./app-server-factory/rate-limit-configurer');
 const http = require('http');
 const https = require('https');
@@ -61,21 +66,8 @@ class AppServerFactory
         this.defaultDomain = '';
         this.maxRequestSize = '10mb';
         this.sanitizeOptions = {allowedTags: [], allowedAttributes: {}};
-        this.cacheConfig = {
-            '.css': 31536000,
-            '.js': 31536000,
-            '.woff': 31536000,
-            '.woff2': 31536000,
-            '.ttf': 31536000,
-            '.eot': 31536000,
-            '.jpg': 2592000,
-            '.jpeg': 2592000,
-            '.png': 2592000,
-            '.gif': 2592000,
-            '.webp': 2592000,
-            '.svg': 2592000,
-            '.ico': 2592000
-        };
+        this.cacheConfig = ServerDefaultConfigurations.cacheConfig;
+        this.serverHeaders = new ServerHeaders();
         this.staticOptions = {
             maxAge: '1d',
             immutable: false,
@@ -98,6 +90,7 @@ class AppServerFactory
         this.securityConfigurer = new SecurityConfigurer();
         this.corsConfigurer = new CorsConfigurer();
         this.rateLimitConfigurer = new RateLimitConfigurer();
+        this.reverseProxyConfigurer = new ReverseProxyConfigurer();
         this.useCompression = true;
         this.compressionOptions = {
             level: 6,
@@ -109,28 +102,32 @@ class AppServerFactory
                 return compression.filter(req, res);
             }
         };
+        this.http2CdnEnabled = false;
+        this.http2CdnPort = 8443;
+        this.http2CdnKeyPath = '';
+        this.http2CdnCertPath = '';
+        this.http2CdnHttpsChain = '';
+        this.http2CdnStaticPaths = [];
+        this.http2CdnCorsOrigins = [];
+        this.http2CdnCorsAllowAll = false;
+        this.http2CdnMimeTypes = {};
+        this.http2CdnCacheConfig = {};
+        this.http2CdnServer = false;
+        this.reverseProxyEnabled = false;
+        this.reverseProxyRules = [];
     }
 
     buildStaticHeaders(res, path)
     {
-        res.set('X-Content-Type-Options', 'nosniff');
-        res.set('X-Frame-Options', 'DENY');
-        res.set('Vary', 'Accept-Encoding');
-        let cacheMaxAge = this.getCacheConfigForPath(path);
-        if(cacheMaxAge){
-            res.set('Cache-Control', 'public, max-age='+cacheMaxAge+', immutable');
+        let securityHeaderKeys = Object.keys(this.serverHeaders.expressSecurityHeaders);
+        for(let headerKey of securityHeaderKeys){
+            res.set(headerKey, this.serverHeaders.expressSecurityHeaders[headerKey]);
         }
-    }
-
-    getCacheConfigForPath(path)
-    {
-        let cacheKeys = Object.keys(this.cacheConfig);
-        for(let ext of cacheKeys){
-            if(path.endsWith(ext)){
-                return this.cacheConfig[ext];
-            }
+        res.set('Vary', this.serverHeaders.expressVaryHeader);
+        let cacheMaxAge = ServerFactoryUtils.getCacheConfigForPath(path, this.cacheConfig);
+        if(cacheMaxAge){
+            res.set('Cache-Control', this.serverHeaders.buildCacheControlHeader(cacheMaxAge));
         }
-        return false;
     }
 
     createAppServer(appServerConfig)
@@ -148,6 +145,7 @@ class AppServerFactory
         this.setupCors();
         this.setupRateLimiting();
         this.setupRequestParsing();
+        this.setupReverseProxy();
         this.setupTrustedProxy();
         try {
             this.appServer = this.createServer();
@@ -157,14 +155,48 @@ class AppServerFactory
         }
         if(!this.appServer){
             if(!this.error.message){
-                this.error = {message: 'The createServer() returned false - check certificate paths and permissions'};
+                this.error = {message: 'The createServer() returned false - check certificate paths and permissions.'};
             }
             return false;
         }
+        if(this.http2CdnEnabled){
+            if(!this.createHttp2CdnServer()){
+                this.error = {message: 'The createHttp2CdnServer() returned false.'};
+                return false;
+            }
+        }
         if(this.autoListen){
             this.listen();
         }
-        return {app: this.app, appServer: this.appServer};
+        return {app: this.app, appServer: this.appServer, http2CdnServer: this.http2CdnServer};
+    }
+
+    createHttp2CdnServer()
+    {
+        this.http2CdnServer = new Http2CdnServer();
+        this.http2CdnServer.enabled = this.http2CdnEnabled;
+        this.http2CdnServer.port = this.http2CdnPort;
+        this.http2CdnServer.keyPath = this.http2CdnKeyPath || this.keyPath;
+        this.http2CdnServer.certPath = this.http2CdnCertPath || this.certPath;
+        this.http2CdnServer.httpsChain = this.http2CdnHttpsChain || this.httpsChain;
+        this.http2CdnServer.staticPaths = this.http2CdnStaticPaths;
+        this.http2CdnServer.cacheConfig = this.http2CdnCacheConfig && 0 < Object.keys(this.http2CdnCacheConfig).length
+            ? this.http2CdnCacheConfig
+            : this.cacheConfig;
+        if(this.http2CdnMimeTypes && 0 < Object.keys(this.http2CdnMimeTypes).length){
+            this.http2CdnServer.mimeTypes = this.http2CdnMimeTypes;
+        }
+        this.http2CdnServer.corsOrigins = this.http2CdnCorsOrigins;
+        this.http2CdnServer.corsAllowAll = this.http2CdnCorsAllowAll;
+        if(!this.http2CdnServer.create()){
+            this.error = this.http2CdnServer.error;
+            return false;
+        }
+        if(!this.http2CdnServer.listen()){
+            this.error = this.http2CdnServer.error;
+            return false;
+        }
+        return true;
     }
 
     extractDomainFromHttpUrl(url)
@@ -209,12 +241,14 @@ class AppServerFactory
         }
         this.staticOptions.immutable = false;
         this.staticOptions.setHeaders = (res, path) => {
-            res.set('X-Content-Type-Options', 'nosniff');
-            res.set('X-Frame-Options', 'SAMEORIGIN');
-            res.set('Cache-Control', 'no-cache, no-store, must-revalidate');
-            res.set('Pragma', 'no-cache');
-            res.set('Expires', '0');
-            res.set('Vary', 'Accept-Encoding');
+            let securityHeaderKeys = Object.keys(this.serverHeaders.expressSecurityHeaders);
+            for(let headerKey of securityHeaderKeys){
+                res.set(headerKey, this.serverHeaders.expressSecurityHeaders[headerKey]);
+            }
+            res.set('Cache-Control', this.serverHeaders.expressCacheControlNoCache);
+            res.set('Pragma', this.serverHeaders.expressPragma);
+            res.set('Expires', this.serverHeaders.expressExpires);
+            res.set('Vary', this.serverHeaders.expressVaryHeader);
         };
     }
 
@@ -308,6 +342,18 @@ class AppServerFactory
         }
     }
 
+    setupReverseProxy()
+    {
+        if(!this.reverseProxyEnabled || 0 === this.reverseProxyRules.length){
+            return;
+        }
+        this.reverseProxyConfigurer.setup(this.app, {
+            reverseProxyRules: this.reverseProxyRules,
+            isDevelopmentMode: this.isDevelopmentMode,
+            useVirtualHosts: this.useVirtualHosts
+        });
+    }
+
     setupTrustedProxy()
     {
         if('' !== this.trustedProxy){
@@ -545,6 +591,9 @@ class AppServerFactory
 
     async close()
     {
+        if(this.http2CdnServer){
+            await this.http2CdnServer.close();
+        }
         if(!this.appServer){
             return true;
         }

package/lib/http2-cdn-server.js

@@ -0,0 +1,161 @@
+/**
+ *
+ * Reldens - Http2CdnServer
+ *
+ */
+
+const http2 = require('http2');
+const path = require('path');
+const { FileHandler } = require('./file-handler');
+const { ServerDefaultConfigurations } = require('./server-default-configurations');
+const { ServerFactoryUtils } = require('./server-factory-utils');
+const { ServerHeaders } = require('./server-headers');
+
+class Http2CdnServer
+{
+
+    constructor()
+    {
+        this.enabled = false;
+        this.port = 8443;
+        this.keyPath = '';
+        this.certPath = '';
+        this.httpsChain = '';
+        this.staticPaths = [];
+        this.cacheConfig = ServerDefaultConfigurations.cacheConfig;
+        this.allowHTTP1 = true;
+        this.http2Server = false;
+        this.error = {};
+        this.mimeTypes = ServerDefaultConfigurations.mimeTypes;
+        this.corsOrigins = [];
+        this.corsAllowAll = false;
+        this.serverHeaders = new ServerHeaders();
+        this.corsMethods = this.serverHeaders.http2CorsMethods;
+        this.corsHeaders = this.serverHeaders.http2CorsHeaders;
+        this.securityHeaders = this.serverHeaders.http2SecurityHeaders;
+        this.varyHeader = this.serverHeaders.http2VaryHeader;
+    }
+
+    create()
+    {
+        if(!this.keyPath || !this.certPath){
+            this.error = {message: 'Missing SSL certificates'};
+            return false;
+        }
+        let key = FileHandler.readFile(this.keyPath);
+        if(!key){
+            this.error = {message: 'Could not read key from: '+this.keyPath};
+            return false;
+        }
+        let cert = FileHandler.readFile(this.certPath);
+        if(!cert){
+            this.error = {message: 'Could not read cert from: '+this.certPath};
+            return false;
+        }
+        let options = {key, cert, allowHTTP1: this.allowHTTP1};
+        if(this.httpsChain){
+            let ca = FileHandler.readFile(this.httpsChain);
+            if(ca){
+                options.ca = ca;
+            }
+        }
+        this.http2Server = http2.createSecureServer(options);
+        this.setupStreamHandler();
+        return true;
+    }
+
+    setupStreamHandler()
+    {
+        this.http2Server.on('stream', (stream, headers) => {
+            this.handleStream(stream, headers);
+        });
+    }
+
+    handleStream(stream, headers)
+    {
+        let requestPath = headers[':path'];
+        if(!requestPath){
+            stream.respond({':status': 400});
+            stream.end();
+            return;
+        }
+        let requestOrigin = headers['origin'] || '';
+        let allowedOrigin = ServerFactoryUtils.validateOrigin(requestOrigin, this.corsOrigins, this.corsAllowAll);
+        if('OPTIONS' === headers[':method']){
+            let optionsHeaders = {':status': 200};
+            if(allowedOrigin){
+                optionsHeaders['access-control-allow-origin'] = allowedOrigin;
+            }
+            optionsHeaders['access-control-allow-methods'] = this.corsMethods;
+            optionsHeaders['access-control-allow-headers'] = this.corsHeaders;
+            stream.respond(optionsHeaders);
+            stream.end();
+            return;
+        }
+        let filePath = this.resolveFilePath(requestPath);
+        if(!filePath){
+            stream.respond({':status': 404});
+            stream.end();
+            return;
+        }
+        let ext = path.extname(filePath);
+        let cacheAge = ServerFactoryUtils.getCacheConfigForPath(filePath, this.cacheConfig);
+        let responseHeaders = {':status': 200};
+        let securityKeys = Object.keys(this.securityHeaders);
+        for(let headerKey of securityKeys){
+            responseHeaders[headerKey] = this.securityHeaders[headerKey];
+        }
+        if(allowedOrigin){
+            responseHeaders['access-control-allow-origin'] = allowedOrigin;
+        }
+        if(this.varyHeader){
+            responseHeaders['vary'] = this.varyHeader;
+        }
+        if(cacheAge){
+            responseHeaders['cache-control'] = 'public, max-age='+cacheAge+', immutable';
+        }
+        if(this.mimeTypes[ext]){
+            responseHeaders['content-type'] = this.mimeTypes[ext];
+        }
+        stream.respondWithFile(filePath, responseHeaders);
+    }
+
+    resolveFilePath(requestPath)
+    {
+        let cleanPath = ServerFactoryUtils.stripQueryString(requestPath);
+        for(let staticPath of this.staticPaths){
+            let fullPath = path.join(staticPath, cleanPath);
+            if(!FileHandler.exists(fullPath)){
+                continue;
+            }
+            if(!FileHandler.isFile(fullPath)){
+                continue;
+            }
+            return fullPath;
+        }
+        return false;
+    }
+
+    listen()
+    {
+        if(!this.http2Server){
+            this.error = {message: 'HTTP2 server not created'};
+            return false;
+        }
+        this.http2Server.listen(this.port);
+        return true;
+    }
+
+    async close()
+    {
+        if(!this.http2Server){
+            return true;
+        }
+        return new Promise((resolve) => {
+            this.http2Server.close(() => resolve(true));
+        });
+    }
+
+}
+
+module.exports.Http2CdnServer = Http2CdnServer;