An express middleware to validate route clients
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
lib Initial public release Aug 30, 2017
src
test Initial public release Aug 30, 2017
.gitignore Initial public release Aug 30, 2017
.npmignore Initial public release Aug 30, 2017
.npmrc Initial public release Aug 30, 2017
CONTRIBUTING.md Initial public release Aug 30, 2017
LICENSE Initial public release Aug 30, 2017
MAINTAINERS Initial public release Aug 30, 2017
README.md
package.json Initial public release Aug 30, 2017

README.md

Client Validator for Express routes

The purpose of this module is to be plugged in as a middleware when an app needs to validate the requests are coming from allowable clients.

Install the module

npm install save express-client-validator

Usage

RouteClientValidator = require 'express-client-validator'
{validator} = RouteClientValidator

Initialize the restricted routes and pass it to the validator during configuration

e.g.
routes = [
    {
        url : '/'
        methods : ['GET','PUT','POST','DELETE']
        clientIds :  ['CLIENT-A']            
    }
    {
        url : '/route-1/?'
        methods : ['GET','PUT','POST','DELETE']
        clientIds :  ['CLIENT-A','CLIENT-C']            
    }
]

The middleware takes in a list of restricted routes which means the client is free to choose the store for its route definitions. E.g. it could be stored either in a database, or as part of CF service bindings or maybe a bundled json in the app

  1. Below configuration will use the default client-id as the header param to lookup in the request e.g.

    RouteClientValidator.configure({routes})

  2. If the clientId is stored in a custom header you can pass it as headerClientKey during config e.g.

    RouteClientValidator.configure({headerClientKey:'custom_client_id', routes})

Configure the middleware

Given app is the express router, the validator can be configured as below

app.use '/', validator

Fire up the app and now all the routes would be validated as per the restrictions defined during configuration

Routes are

The list of routes should contain at least one route definition

property validations
url has to be non empty string
method should be a string array containing at least one http method e.g. ['GET','PUT'] etc.
clientIds should be a list of client ids that are allowed for the given url. If the endpoint needs to be open for all leave it as empty array []

How to define routes

url method cliendIds What does it mean
/route-1 ['PUT','POST','DELETE'] ['CLIENT-A'] Only client CLIENT-A is allowed to call /route-1 POST, PUT, DELETE routes
/route-1 ['GET'] [ ] All clients can call the /route-1 GET endpoint
/ ['GET','HEAD','PUT','POST','DELETE'] ['CLIENT-B'] Only client CLIENT-B is allowed to call / GET, HEAD, POST, PUT, DELETE routes

Note: The restricted routes are evaluated by matching from distinct to partial matches.

e.g. in the above table since client CLIENT-B is allowed for / means an endpoint like /route-2 is allowed to CLIENT-B but not any other clients

however CLIENT-B will not be allowed to call /route-1 endpoint since it is restricted to client CLIENT-A

If CLIENT-B needs to access /route-1 as well then it needs to be explicitly defined

e.g

routes = [
    {
        url : '/route-1'
        methods : ['PUT','POST','DELETE']
        clientIds :  ['CLIENT-A','CLIENT-B']            
    }
]

URL path params can be specified with a ? which the validator will replace with this regex ([-A-z0-9@:%$_\+.~#])+ for pattern matching

e.g. defining a route url like below 
routes = [
    {
        url : '/route-1/?/child-route'
        ...
    }
]

will match request with urls like

/route-1/xyz/child-route
/route-1/1234/child-route
/route-1/xyz-00$1/child-route

Query params are automatically handled by the validator by matching using this regex ([-A-z0-9\/?@:%$_&=\+.~#])*