RisingStack Blog

This title has been changed from its original. Mods?

Node.js applications are one thing, Express.js applications are another. This seems to talk about the Express.js framework, and Express has its own set of guidelines that should be followed as the bare minimum, sadly in the "advanced" section:

https://expressjs.com/en/advanced/best-practice-security.html

https://blog.risingstack.com/node-js-security-checklist/

In reality I see two things that bite most outfits getting their feet wet with Node for the first time, and it's not how well the passwords are hashed.

First is the age-old problem of input validation. Express.js devs read the tutorials that show bringing in data directly from req:

https://expressjs.com/en/api.html#req

... and just accept it. Unvalidated input / unfiltered output seems par for the course in a lot of smaller Express.js APIs, especially when they are using Angular, Knockout or another client-side framework that offers some filtering of data being returned from the API.

A close second is third-party dependencies. While the Node Security Project does what it can to help out, and nsp/snyk are good best practices, the Node.js culture of importing modules for everything often leads to really large attack surfaces with rarely-audited modules of unknown provenance added for development speed. Third-party modules -- especially less popular ones -- are a goldmine of critical vulnerabilities just as WordPress plugins used to be (and still are).

Also, a…

You have a number of ways of keeping a handle on async code now.

1. Native ES6 promises will cover most of your basic needs. See https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/Promise. In fact, unless you have very specific needs not covered by native promises, you shouldn't drop a third party library into your project.

2. For more advanced operations on promises, use Bluebird. See http://bluebirdjs.com and http://bluebirdjs.com/docs/api-reference.html. It has a ton of features built on top of native ES6 promises. If you're using an older version of Node, it also acts as a polyfill. It can also make it easy to work with libraries that only expose a callback-based interface. So yeah, Bluebird is the shit.

3. co is a generator-based control flow library that can make your async code look more like synchronous code. It's pretty cool, but I haven't personally used it in a project, nor do I know of anyone else who uses it. It builds on top of promises and generators, and isn't very hard to understand under the hood. See https://github.com/tj/co. I wouldn't recommend it, but it might be something to play with because ...

4. ... async/await is coming to JavaScript! At a very high level, this pair of keywords is syntax sugar for what co already does as a library. This is the final stage in the evolution of taming callback hell in JavaScript, and it builds on top of everything that has come before (promises and generators). Here's a tutorial:…

For traditional sessions:

1. All You Ever Wanted to Know About Sessions In Node.js (Stormpath) - https://stormpath.com/blog/everything-you-ever-wanted-to-know-about-node-dot-js-sessions

2. Express.js Production Best Practices - https://expressjs.com/en/advanced/best-practice-security.html

3. express-session (npm module) - https://ewiggin.gitbooks.io/expressjs-middleware/content/express-session.html

4. Node.js authentication strategy using Passport.js and Redis - https://blog.risingstack.com/node-hero-node-js-authentication-passport-js/

For JSON Web Tokens:

1. JWT Handbook: https://auth0.com/e-books/jwt-handbook

2. IETF Specification: https://tools.ietf.org/html/rfc7519

3. https://jwt.io/

4. Authentication in React Applications, Part 2: JSON Web Tokens - https://vladimirponomarev.com/blog/authentication-in-react-apps-jwt

6. Token Authentication Implementation - https://docs.docker.com/registry/spec/auth/jwt/

7. JWT Validation and Authorization in ASP.NET Core - https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/

"Almost a decade"

About 5 years tbh: https://blog.risingstack.com/history-of-node-js/

"hardly find any large, well-known website being powered by node"

* Netflix - https://www.talentbuddy.co/blog/building-with-node-js-at-netflix/

* New York Times - https://www.talentbuddy.co/blog/building-with-node-js-at-the-new-york-times/

* PayPal - https://www.talentbuddy.co/blog/building-with-node-js/

* Medium - https://www.talentbuddy.co/blog/on-building-with-node-js-at-medium-and-growing-as-a-developer/

* LinkedIn - https://www.talentbuddy.co/blog/building-with-node-js-at-linkedin/

* Uber - https://www.joyent.com/developers/videos/node-js-office-hours-curtis-chambers-uber

It's a tool, and like every other tool comes with its pros and cons. I am not saying Node is the perfect fit for any project, because it isn't. However stating it isn't used and almost a decade is just wrong.

Docker is mainly an app packaging mechanism of sorts. Just like you would build a jars, wars or rpms, etc. you create docker images for your applications. The advantage you get is that you can package all your dependencies in the container thereby making your application independent and using the tools provided by docker in combination with swarm, compose, etc. it makes deployment of your apps and scaling easier.

OpenVZ, LXC, solaris zones and bsd jails on the other hand or mainly run complete OS and the focus is quite different from packaging your applications and deployments.

You can also have a look at this blog which explains the differences more in detail: http://blog.risingstack.com/operating-system-containers-vs-application-containers/

1. Fees on chains made for transactions are pennies (Google "X transaction fees" where x = solana, polygon, bitcoin lightning, etc.)

2. I'd expect a project trying to create digital money to take a bit more time then a JS framework[1]. Does that seem reasonable? It took React 6 years to "go mainstream" and had the backing of Facebook. It's hard to do consequential things in the real world, it will take time.

3. Why do you think it won't happen? Just because it's taking a long time? It's a big change with a ton at risk if it goes wrong. It's going to take a while to happen.

1 - https://blog.risingstack.com/the-history-of-react-js-on-a-timeline/