From 164737dd831b4f92a5d152a704cc89af7f65fd20 Mon Sep 17 00:00:00 2001 From: ben hockey Date: Wed, 24 Sep 2014 10:21:20 -0500 Subject: [PATCH 1/3] remove websocket-server working on replacing it with socket.io --- package.json | 1 - start-node.js | 11 ----------- 2 files changed, 12 deletions(-) diff --git a/package.json b/package.json index 72259c0..7e484fc 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,6 @@ "dependencies":{ "tunguska": ">=0.3.0", "rql": ">=0.3.1", - "websocket-server": ">=1.4.01", "perstore": ">=0.3.0", "promised-io": ">=0.3.0", "formidable": ">=1.0.0", diff --git a/start-node.js b/start-node.js index d82b556..582c12d 100644 --- a/start-node.js +++ b/start-node.js @@ -1,6 +1,5 @@ // helpful for debugging var settings = require("perstore/util/settings"), - ws = require("websocket-server"), messageJson = require("./media/message/json"); exports.start = function(jsgiApp){ @@ -9,16 +8,6 @@ exports.start = function(jsgiApp){ ); var port = settings.port || process.env.PORT || 80; server.listen(port); - require("jsgi-node/ws-jsgi")(ws.createServer({ - server: server - }), function(request){ - request.method = "POST"; - var headers = request.headers; - headers.accept = "message/json"; - headers["content-type"] = "message/json"; - headers.stream = true; - return jsgiApp(request); - }); console.log("Listening on port " + port); return server; From 96053e2688c4494d657d9d7fcc9db3c0b6f679e1 Mon Sep 17 00:00:00 2001 From: ben hockey Date: Wed, 24 Sep 2014 16:43:45 -0500 Subject: [PATCH 2/3] switch to use ws instead of websocket-server websocket-server is unpublished so updating to an alternative --- package.json | 47 +++++++++++++++++++++++++---------------------- start-node.js | 11 ++++++++++- 2 files changed, 35 insertions(+), 23 deletions(-) diff --git a/package.json b/package.json index 7e484fc..a673bfa 100644 --- a/package.json +++ b/package.json @@ -4,15 +4,17 @@ "author": "Kris Zyp", "email": "kriszyp@gmail.com", "description": "JSGI-based RESTful JSON/JavaScript server", - "contributors": ["Vladimir Dronnikov "], + "contributors": [ + "Vladimir Dronnikov " + ], "keywords": [ "rest", "database", "web", "json", "persevere" - ], - "mappings":{ + ], + "mappings": { "perstore": "http://github.com/kriszyp/perstore/zipball/v0.2.4", "templify": "http://github.com/dmachi/templify/zipball/master", "promised-io": "jar:http://github.com/kriszyp/promised-io/zipball/v0.2.3!/", @@ -35,36 +37,37 @@ } }, "licenses": [ - { - "type": "AFLv2.1", - "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L43" - }, - { - "type": "BSD", - "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L13" - } + { + "type": "AFLv2.1", + "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L43" + }, + { + "type": "BSD", + "url": "http://trac.dojotoolkit.org/browser/dojo/trunk/LICENSE#L13" + } ], "repository": { - "type":"git", - "url":"http://github.com/persvr/pintura" + "type": "git", + "url": "http://github.com/persvr/pintura" }, "directories": { "lib": "." }, "maintainers": [ - { - "name": "Kris Zyp", - "email": "kriszyp@gmail.com" - } + { + "name": "Kris Zyp", + "email": "kriszyp@gmail.com" + } ], - "dependencies":{ - "tunguska": ">=0.3.0", - "rql": ">=0.3.1", + "dependencies": { + "formidable": ">=1.0.0", + "jsgi-node": ">=0.2.5", "perstore": ">=0.3.0", "promised-io": ">=0.3.0", - "formidable": ">=1.0.0", + "rql": ">=0.3.1", "templify": ">=0.9.0", - "jsgi-node": ">=0.2.5" + "tunguska": ">=0.3.0", + "ws": "^0.4.32" }, "devDependencies": { "patr": ">=0.2.6" diff --git a/start-node.js b/start-node.js index 582c12d..879907e 100644 --- a/start-node.js +++ b/start-node.js @@ -1,5 +1,6 @@ // helpful for debugging var settings = require("perstore/util/settings"), + ws = require("ws"), messageJson = require("./media/message/json"); exports.start = function(jsgiApp){ @@ -8,7 +9,15 @@ exports.start = function(jsgiApp){ ); var port = settings.port || process.env.PORT || 80; server.listen(port); - + require("jsgi-node/ws-jsgi")(ws.createServer({ server: server }), function(request){ + request.method = "POST"; + var headers = request.headers; + headers.accept = "message/json"; + headers["content-type"] = "message/json"; + headers.stream = true; + return jsgiApp(request); + }); + console.log("Listening on port " + port); return server; }; From b877156a66e86898e060c827ac3479c82635077e Mon Sep 17 00:00:00 2001 From: ben hockey Date: Thu, 25 Sep 2014 13:46:41 -0500 Subject: [PATCH 3/3] account for websocket requests in csrf --- jsgi/csrf.js | 1 + 1 file changed, 1 insertion(+) diff --git a/jsgi/csrf.js b/jsgi/csrf.js index 3b0ba92..b2c0770 100644 --- a/jsgi/csrf.js +++ b/jsgi/csrf.js @@ -12,6 +12,7 @@ var CSRFDetect = function(customHeader, nextApp){ var headers = request.headers; if(!(headers[customHeader] || /application\/j/.test(headers.accept) || (request.method == "POST" && headers.referer && headers.referer.indexOf(headers.host + '/') > 0) || + (headers.stream && headers.origin && headers.origin.indexOf(headers.host) > 0) || (request.method != "GET" && request.method != "POST"))){ request.crossSiteForgeable = true; }