Securing files in Google Cloud app engine (NodeJS)

Question

I have created a small web application with NodeJS Express. Basically a webserver that has a 'webserver.properties' file. With a very basic app.yaml file.

After deploying it to Google Cloud by use of 'gcloud app deploy' I get the everything up and running.

However...when I open the following URL in the browser: https://webserverurl.com/webserver.properties , the webserver.properties file can be approached and is in turn downloaded immediately.

How can I prevent this from happening and make sure that such properties files are inaccessible from outside?

Answer 1

The problem is that when you use this line:

app.use('/', express.static(__dirname + '/')); 

you are giving access to your root directory. See this for a definition of __dirname . If you want to give access to a specific folder you can do this:

Lets say your root directory is src and you fave a dir with static files called src/myfiles . In order to give acces to files in myfiles you can use this line:

app.use('/mypathname', express.static('myfiles'));

where:

1. '/mypathname' is the part pertaining your URL. In your case it would be https://webserverurl.com/mypathname/any-file-name.jpg

2. express.static('myfiles') is the name of your local dir.

See this guide .

Hope this helps