-
Notifications
You must be signed in to change notification settings - Fork 0
/
app.js
69 lines (55 loc) · 1.71 KB
/
app.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
const express = require("express");
const morgan = require("morgan");
const rateLimit = require("express-rate-limit");
const helmet = require("helmet");
const mongoSanitize = require("express-mongo-sanitize");
const xss = require("xss-clean");
const hpp = require("hpp");
const AppError = require("./utils/appError");
const globalErrorHandler = require("./controllers/errorControllers");
const tourRouter = require("./routes/tourRoutes");
const userRouter = require("./routes/userRoutes");
const reviewRouter = require("./routes/reviewRoutes");
const app = express();
// Set secure HTTP headers
app.use(helmet());
// Development logging
if (process.env.NODE_ENV === "development") {
app.use(morgan("dev"));
}
// Limit request form same ip
const limiter = rateLimit({
windowMs: 60 * 60 * 1000, // 1 hour
max: 100, // limit each IP to 100 requests per windowMs
message: "Too many request from this ip address, please try again later."
});
app.use("/api", limiter);
// Body parser, parse data from req.body
app.use(express.json({ limit: "10kb" }));
// Data sanitization against NoSQL query injection
app.use(mongoSanitize());
// Data sanitization against XSS
app.use(xss());
// Prevent parameter pollution
app.use(
hpp({
whitelist: [
"duration",
"ratingsQuantity",
"ratingsAverage",
"maxGroupSize",
"difficulty",
"price"
]
})
);
// Serving static files
app.use(express.static(`${__dirname}/public`));
app.use("/api/v1/tours", tourRouter);
app.use("/api/v1/users", userRouter);
app.use("/api/v1/reviews", reviewRouter);
app.all("*", (req, res, next) => {
next(new AppError(`Can't find ${req.originalUrl} on this server!`, 404));
});
app.use(globalErrorHandler);
module.exports = app;