1import express from "express";
2
3import config from "./config.js";
4import router from "./routes.js";
5
6const app = express();
7
8// --- start of helmet security
9// ref: https://helmetjs.github.io/faq/you-might-not-need-helmet/
10app.disable("x-powered-by");
11// helmet headers
12const HELMET_HEADERS = {
13 "Content-Security-Policy":
14 "default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests",
15 "Cross-Origin-Opener-Policy": "same-origin",
16 "Cross-Origin-Resource-Policy": "same-origin",
17 "Origin-Agent-Cluster": "?1",
18 "Referrer-Policy": "no-referrer",
19 "Strict-Transport-Security": "max-age=15552000; includeSubDomains",
20 "X-Content-Type-Options": "nosniff",
21 "X-DNS-Prefetch-Control": "off",
22 "X-Download-Options": "noopen",
23 "X-Frame-Options": "SAMEORIGIN",
24 "X-Permitted-Cross-Domain-Policies": "none",
25 "X-XSS-Protection": "0",
26};
27
28app.use((req, res, next) => {
29 res.set(HELMET_HEADERS);
30 next();
31});
32// --- end of helmet security
33
34// http logger
35app.use((req, res, next) => {
36 res.on("finish", function () {
37 console.log(req.method, decodeURI(req.url), res.statusCode);
38 });
39 next();
40});
41app.use(express.urlencoded({ extended: true }));
42
43app.use(`${config.basePath}`, router);
44
45// 404 and other error handlers
46app.use((req, res, next) => {
47 next({ statusCode: 404, message: "Not found" });
48});
49
50app.use((err, req, res, next) => {
51 let statusCode = err.statusCode || 500;
52 let message = err.message || "Unkown error happened";
53
54 return res.status(statusCode).send(message);
55});
56
57app.listen(config.port, () => {
58 console.log(`[${config.appName}] server listening on port ${config.port}`);
59 console.log(`base path: ${config.basePath}`);
60});