Problem with nodejs static route and files

Question

In my project I have a report hat is reachable with index.html But this is private and I want to protect / limit access with my node app. for this I use

app.use('/allure', express.static(path.join(__alluredir , 'allure-report/')));

Then I use for bugging purpose

app.all('/allure/*', function(req, res, next) {

console.log("catched allure query");
next(); // allow the next route to run

});

But the index.html is still reachable with localhost:8080/allure/index.hmtl and also just with localhost:8080/allure/ without an console output. This confuse a lot. Anybody has an idea how to hinder access the index.html without logged in? (Is use passport)

my whole app.js file is:

const express = require('express');
const app = express();
var http = require('http').Server(app);
var io = require('socket.io')(http);
const expressLayouts = require('express-ejs-layouts');
const mongoose = require('mongoose');
const passport = require('passport');
const flash = require('connect-flash');
const session = require('express-session');
var bodyParser = require('body-parser');
const fs = require('fs');
const path = require('path');
var favicon = require('serve-favicon')
const { allureGenerator } = require('./ops/copyalluredata');

app.set('socketio', io);
//app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json({ type: 'application/json' }));
app.use(bodyParser.urlencoded({
    parameterLimit: 100000,
    limit: '50mb',
    extended: true
}));


var appDir = path.dirname(require.main.filename);
global.__basedir = appDir;
global.__alluredir = process.env.REPORT_DIR_ENV;

fs.readFile(path.join(appDir, '/config.xml'), (err, data) => {
    if (err) throw err;
    myConfigData = JSON.parse(data);

    process.env.BROWSERSTACK_USERNAME = myConfigData.browserstackid;
    process.env.BROWSERSTACK_ACCESS_KEY = myConfigData.browserstackkey;
    process.env.BROWSERSTACK_DISPLAY_RESOLUTION="1600x1200";

    console.log('config gelesen');

});

//Diese Funktion schreibt die benötigten Dateien in den allure Modul Ordner damit das Logo verwendet wird.
allureGenerator();

// Passport Config
require(path.join(appDir, '/config/passport'))(passport);
// DB Config
var db = '';
if (process.env.NODE_ENV == 'home') {
    db = require(path.join(appDir, '/config/keys')).mongoURI;
    console.log('keys');
}else{
    db = require(path.join(appDir, '/config/keys_local')).mongoURI;
    console.log('keys_local');
}

// Connect to MongoDB
mongoose
    .connect(
        db,
        { useNewUrlParser: true }
    )
    .then(() => console.log('MongoDB Connected'))
    .catch(err => console.log(err));


app.use('/allure', express.static(path.join(__alluredir , 'allure-report/')));
app.use(express.static(appDir));

// EJS
app.use(expressLayouts);
app.set('view engine', 'ejs');
app.set('views', path.join(appDir, '/views'));


app.use(
    session({
        secret: 'secret',
        resave: true,
        saveUninitialized: true
    })
);

app.use(favicon(path.join(__dirname, 'css', 'fvicon.ico')))

app.use(passport.initialize());
app.use(passport.session());

// Connect flash
app.use(flash());


// Global variables
app.use(function(req, res, next) {
    res.locals.success_msg = req.flash('success_msg');
    res.locals.error_msg = req.flash('error_msg');
    res.locals.error = req.flash('error');
    next();
});

// Routes
app.use('/', require('./routes/index.js'));
app.use('/users', require('./routes/users.js'));
app.use('/cases', require('./routes/cases.js'));
app.use('/tcafe', require('./routes/tcafe.js'));
app.use('/imgtest', require('./routes/imgtest.js'));
app.use('/rapitest', require('./routes/restapitest.js'));



io.on('connection', function(socket){
    console.log('a user connected');
});

app.all('/allure/*', function(req, res, next) {

console.log("catched allure query");
next(); // allow the next route to run

});

app.use((req, res, next) => {
    next({
        status: 404,
        message: 'Not Found',
    });
});

app.use((err, req, res, next) => {
    if (err.status === 404) {
        return res.status(400).render('404',{ layout: 'system.ejs' });
    }

    if (err.status === 500) {
        return res.status(500).render('500');
    }

    next();
});


const PORT = process.env.PORT || 8080;

http.listen(PORT, console.log(`Server started on port ${PORT}`));

You can use a middleware for the report route to check if the user is loggedIn by Token if your are using JWT or on user log in create cookie for this matter, otherwise use passport sessions. — abnaceur

Abhay Abhay · Accepted Answer · 2020-02-15T23:10:47

You can use something like this Or just use somemiddleware-

app.use('/allure', function(req,res,next){
   if(<authenticate check>){ // some kind of authenticate check
     return express.static(path.join(__dirname, 'allure'));
   } else {
      <Any error you want to show>
   }
});

OR

app.use('/allure',<Auth Middlewarae> , express.static(path.join(__dirname, 'allure')));

Problem with nodejs static route and files

1 Answers