ExpressJS限制对公共文件的访问

Question

Is there a way to hide files that are being served by the Node server? I have tried to reroute certain files and directories, but nothing is working in Express 4.X. I have also tried to send 4XX HTTP responses when certain files are requested, but this only works for directory paths. No matter what I do, if there is a file that is being served by Node, then the user is going to be able to see the source code. Is this just how Express works? Is it meant to be a development framework over a production framework?

Right now I am trying to send bad responses.

full server.js

var path = require('path'),
   express = require('express'),

var app = express();

app.use('/', express.static(__dirname));
app.use('/', express.static('dist'));

// not working
app.get('/client/config/app.js', function(req, res) {
   res.sendStatus(400);
});

app.listen(3001, function() {
   console.log('listening');
});

I am able to send a response if I specify a directory path, but not if I specify a full file path. This works:

app.get('/client/config/', function(req, res) {
   res.sendStatus(400);
});

And this doesn't:

app.get('/client/config/app.js', function(req, res) {
   res.sendStatus(400);
});

I've also tried routing with app.use . That didn't work either.

The best thing I can do right now to "hide" the source code is to uglify it with Gulp, but I imagine it's easy to unravel it with a JS prettifier.

Answer 1

one line culprit

app.use('/', express.static(__dirname));

That line is saying its ok to pull anything. You could replace it with:

app.use('/', express.static(__dirname + '/public'));

Then put stuff in the public directory you want viewed. For routes you want to have as priority, place them before the other declarations. So you would place:

app.get('/client/config/app.js', function(req, res) {
 res.sendStatus(400);
});

above all else. However, seems like you may not need it if you just fix the first problem, then you are good. Also, see HTTP status codes. You would probably want 404 or 403 for that type of file.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html