Node.jsで安全なAPIゲートウェイを構築する方法

1npm init -y
2npm install express --save

1const express = require("express");
2
3const app = express();
4const port = 3000;
5
6app.get("/", (req, res) => {
7  const { name = "user" } = req.query;
8  res.send(`Hello ${name}!`);
9});
10
11app.listen(port, () => {
12  console.log(`Server running at http://localhost:${port}`);
13});

1node index.js

1npm install express-session dotenv --save

1SESSION_SECRET=`<your_secret>`

1require("dotenv").config();
2
3const session = require("express-session");
4
5const secret = process.env.SESSION_SECRET;
6const store = new session.MemoryStore();
7const protect = (req, res, next) => {
8  const { authenticated } = req.session;
9
10  if (!authenticated) {
11    res.sendStatus(401);
12  } else {
13    next();
14  }
15};
16
17app.use(
18  session({
19    secret,
20    resave: false,
21    saveUninitialized: true,
22    store,
23  })
24);

1app.get("/login", (req, res) => {
2  const { authenticated } = req.session;
3
4  if (!authenticated) {
5    req.session.authenticated = true;
6    res.send("Successfully authenticated");
7  } else {
8    res.send("Already authenticated");
9  }
10});
11
12app.get("/logout", protect, (req, res) => {
13  req.session.destroy(() => {
14    res.send("Successfully logged out");
15  });
16});
17
18app.get("/protected", protect, (req, res) => {
19  const { name = "user" } = req.query;
20  res.send(`Hello ${name}!`);
21});

1npm install express-rate-limit --save

1const rateLimit = require("express-rate-limit");
2
3app.use(
4  rateLimit({
5    windowMs: 15 * 60 * 1000, // 15 minutes
6    max: 5, // 5 calls
7  })
8);

1npm install winston express-winston response-time --save

1const winston = require("winston");
2const expressWinston = require("express-winston");
3const responseTime = require("response-time");
4
5app.use(responseTime());
6
7app.use(
8  expressWinston.logger({
9    transports: [new winston.transports.Console()],
10    format: winston.format.json(),
11    statusLevels: true,
12    meta: false,
13    msg: "HTTP {{req.method}} {{req.url}} {{res.statusCode}} {{res.responseTime}}ms",
14    expressFormat: true,
15    ignoreRoute() {
16      return false;
17    },
18  })
19);

1Server running at http://localhost:3000
2{"level":"info","message":"GET / 200 8ms","meta":{}}
3{"level":"warn","message":"GET /favicon.ico 404 3ms","meta":{}}

1npm install cors helmet --save

1const cors = require("cors");
2const helmet = require("helmet");
3
4app.use(cors());
5app.use(helmet());

1npm install http-proxy-middleware --save

1const { createProxyMiddleware } = require("http-proxy-middleware");
2
3app.use(
4  "/search",
5  createProxyMiddleware({
6    target: "http://api.duckduckgo.com/",
7    changeOrigin: true,
8    pathRewrite: {
9      [`^/search`]: "",
10    },
11  })
12);

1require("dotenv").config();
2
3exports.serverPort = 3000;
4exports.sessionSecret = process.env.SESSION_SECRET;
5exports.rate = {
6  windowMs: 5 * 60 * 1000,
7  max: 100,
8};
9exports.proxies = {
10  "/search": {
11    protected: true,
12    target: "http://api.duckduckgo.com/",
13    changeOrigin: true,
14    pathRewrite: {
15      [`^/search`]: "",
16    },
17  },
18};

1const secret = config.sessionSecret;
2...
3const port = config.serverPort;
4...
5app.use(rateLimit(config.rate));

1require("dotenv").config();
2...
3app.use(
4 "/search",
5 createProxyMiddleware({
6   target: "http://api.duckduckgo.com/",
7   changeOrigin: true,
8   pathRewrite: {
9 [`^/search`]: "",
10   },
11 })
12);
13...
14app.get("/", (req, res) => {
15 const { name = "user" } = req.query;
16 res.send(`Hello ${name}!`);
17});
18...
19app.get("/protected", protect, (req, res) => {
20 const { name = "user" } = req.query;
21 res.send(`Hello ${name}!`);
22});

1// import all the required packages
2const cors = require("cors");
3const express = require("express");
4const session = require("express-session");
5const rateLimit = require("express-rate-limit");
6const expressWinston = require("express-winston");
7const helmet = require("helmet");
8const { createProxyMiddleware } = require("http-proxy-middleware");
9const responseTime = require("response-time");
10const winston = require("winston");
11const config = require("./config");
12
13// configure the application
14const app = express();
15const port = config.serverPort;
16const secret = config.sessionSecret;
17const store = new session.MemoryStore();

1const alwaysAllow = (_1, _2, next) => {
2  next();
3};
4const protect = (req, res, next) => {
5  const { authenticated } = req.session;
6
7  if (!authenticated) {
8    res.sendStatus(401);
9  } else {
10    next();
11  }
12};

1app.disable("x-powered-by");
2
3app.use(helmet());
4
5app.use(responseTime());
6
7app.use(
8  expressWinston.logger({
9    transports: [new winston.transports.Console()],
10    format: winston.format.json(),
11    statusLevels: true,
12    meta: false,
13    level: "debug",
14    msg: "HTTP {{req.method}} {{req.url}} {{res.statusCode}} {{res.responseTime}}ms",
15    expressFormat: true,
16    ignoreRoute() {
17      return false;
18    },
19  })
20);
21
22app.use(cors());
23
24app.use(rateLimit(config.rate));
25
26app.use(
27  session({
28    secret,
29    resave: false,
30    saveUninitialized: true,
31    store,
32  })
33);
34
35app.get("/login", (req, res) => {
36  const { authenticated } = req.session;
37
38  if (!authenticated) {
39    req.session.authenticated = true;
40    res.send("Successfully authenticated");
41  } else {
42    res.send("Already authenticated");
43  }
44});

1Object.keys(config.proxies).forEach((path) => {
2  const { protected, ...options } = config.proxies[path];
3  const check = protected ? protect : alwaysAllow;
4  app.use(path, check, createProxyMiddleware(options));
5});
6
7app.get("/logout", protect, (req, res) => {
8  req.session.destroy(() => {
9    res.send("Successfully logged out");
10  });
11});
12
13app.listen(port, () => {
14  console.log(`Server running at http://localhost:${port}`);
15});

1const { readFileSync } = require('fs');
2const { createServer } = require('https');
3
4// assumes that the key and certificate are stored in a "cert" directory
5const credentials = {
6  key: readFileSync('cert/server.key', 'utf8'),
7  cert: readFileSync('cert/server.crt', 'utf8'),
8};
9
10// here we use the express "app" to attach to the created server
11const httpsServer = createServer(credentials, app);

1// use standard HTTPS port
2httpsServer.listen(443);