Node JS Starter kit in SOLID Architecture.
This is the starter kit project for node js with
programming. This project is with
express js and
mongoose frameworks to
build a Rest APIs. This project structure also support with multiple API
protocalls also we build the project with unit testing for end points and
logic codes by
This project also example for best practice node js application
Project structure explanations:
1. api - Write api codes like rest, graphql, socket 2. common - Write common functions to be usable for all the modules 3. config - Write App config code 4. code - Write Application core level code like engine of your your project, service providers 5. models - Wirte database collection models 6. loaders - Write your application modueles and load dependcy of app 7. services - Write application logics 8. subscribers - Write Event subscriber code 9. types - Write application types like interfaces, absracts 10. __test__ - Write jest unit testing code.
Core Concepts of this application.
This application is mainly design for develop a secured, low latency swagger friendly (not yet implemented for swagger) and strong implementation.
Case Study: We are writing api for user registration. In this endpoint logic we are writting the code for user registration if the user data valid the we will send confimation email and return responses. Here we can write send the email confirmation in event emmiter when the user data valid then write the api to return response and emit the user data to send the email confirmation in background.
We can write the async packages to handle the complex asynchronus calls parallely and series
To reduce the latency of an endpoints response we are not added the common middleware like body parser. which added in particularly api calls only. So other API calls can make faster.
Write Test driven development Its an common approach from most of the
developers. Writing an unit testing for project it will make you more confident
to deployment and do not allow your code run in production if it not tested.
Here we are using jest and supertest for endpoints. Use seperate db for unit testing environment.
We are added the pm2 server cofiguration here to run this application in cluster mode to speed up the api calls. We are setting the environmetn varibales for only in development and testing not added for production. Which added in pm2 server So it give an extra layer security for an app. include the pm2-server file in your cloud instance itself. here we added for example.
Use HTTPS/SSL for security, We added helmet and cors setup for improving the security purpose. Adding the secure level module in the middleware only never going to be make your application more secure its about how you are writing also to be consider. use csurf for prevent the CSRF attack.
Case Study: I have seen one web application there they written one api call for the loginned User details by passing id in http query. Even that id is in number format as 1001 when we changed the 1001 to 1002 it gave the details of another uses details. They can get the another user deta. Its became a CSRF loophole. They can get the data by any otherways like JWT token or Auth token. So Writing the code is need to be secured manner. Poor way of coding become a loophole.
Don't make user ids in readable formats. its will helpful to enumrate the other user. Study more about security improvement in OWSAP
Use Rate Limitter for avoid DDoS , brute force attack and dictionary attack on form datas like signin, OTP cracking. We are already using the Helmet it will prevent some browser level attack.
To imporve the low latency of IO calls we are using the Event emitters, async calls for parallel and series asynchronus process.
This project is refered from the following blog and some documents. Reference
Note : This project still in construction mode