Express

• Populärstes Web-Framework für Node.js

import express from 'express';

const app = express();

app.get('/', (req, res) => { // app.METHOD(PATH, HANDLER)
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Example app listening on port 3000!');
});

Query-Parameter

import express from 'express';

const app = express();

// GET /search?q=immobilienkredite
app.get('/search', (req, res) => {
  res.send(`You searched for: ${req.query.q}`);
});

app.listen(3000, () => {
  console.log('Example app listening on port 3000!');
});

Middlewares

app.use((req, res, next) => {
   console.log('before');
   next();
});

app.get('/', (req, res, next) => {
   res.send('Hello');
   next();
});

app.use((req, res, next) => {
   console.log('after');
   next();
});

Middleware Beispiel

import express from 'express';

const app = express();

const requestTime = (req, res, next) => {
  req.requestTime = Date.now();
  next();
};

app.use(requestTime);

app.get('/', (req, res) => {
  res.send(`Page requested at ${req.requestTime}`);
});

app.listen(3000);

Statische Dateien

• Middleware static liefert statische Dateien aus

app.use(express.static('public'));

touch public/styles.css

<link rel="stylesheet" href="/styles.css">

Templates

app.set('view engine', 'ejs'); // views sind vom typ "ejs"
app.set('views', 'views'); // … und liegen im ordner "views" (default)

// render "views/profile.ejs" mit daten aus `user`
res.render('profile', { user: req.user });

<h1>Hallo <%= user.name %></h1>

• default Engine: EJS
• es gibt aber viele viele mehr

Formulare

import bodyParser from 'body-parser';

// für `application/x-www-form-urlencoded` (normale formulare)
app.use(bodyParser.urlencoded({ extended: false }));
// für `application/json` (später wichtig für ajax-zeugs)
app.use(bodyParser.json());

app.post('/login', (req, res) => {
  console.log(req.body.username, req.body.password);
});

Validierung von Formulardaten

• Validation: Prüfen auf bestimmte Muster hin (✔)
• Sanitization: Bereinigen um bestimmte Zeichen (✗)
• Escaping: Umwandeln von Zeichen in andere Darstellungsform (✔)
• validator.js
• Joi
• Big List of Naughty Strings
• DOMPurify

Cookies

import cookieParser from 'cookie-parser';

app.use(cookieParser());

app.use((req, res, next) => {
  req.trackingId = req.cookies.trackingId;

  if (!req.trackingId) {
    const trackingId = Date.now().toString(32);
    res.cookie('trackingId', trackingId);
    req.trackingId = trackingId;
  }

  next();
});

Signed Cookies

• Signiert (HMAC), nicht verschlüsselt

import cookieParser from 'cookie-parser';

app.use(cookieParser('ein geheimnis')); // geheimnis definieren

res.cookie('key', value, { signed: true }); // cookies signiert setzen

const { value } = req.signedCookies; // signierte cookies auslesen

Benutzerverwaltung

import * as argon2 from "argon2";

app.post('/register', (req, res) => {
  argon2.hash(req.body.password).then((hash) => {
    addUser(req.body.email, hash);
    res.redirect('/login');
})});
app.post('/login', (req, res) => {
  argon2.verify(getUser(req.body.email).hash, req.body.password)
    .then(() => { // ✅ korrektes Passwort
      const session = generateToken();
      addSession(session, email);
      res.cookie('session', session, { httpOnly: true, secure: true });
      return res.redirect('/');
    }).catch(() => { // ❌ falsches Passwort
      res.sendStatus(401);
    });
});

Link

• Introduction to Node.js
• The largest Node.js best practices list