Module5-NodeJS-TEST - Revision history

Todd at 17:05, 25 February 2026

2026-02-25T17:05:07Z

Show changes

Todd at 16:26, 25 February 2026

2026-02-25T16:26:38Z

Todd at 16:23, 25 February 2026

2026-02-25T16:23:02Z

Show changes

Todd: /* Your First Node.js Application */

2026-02-25T16:17:03Z

Your First Node.js Application

Todd: /* Modern Syntax: Promises and async/await */

2026-02-25T16:15:05Z

Modern Syntax: Promises and async/await

Todd: /* Non-Blocking I/O */

2026-02-25T16:14:04Z

Non-Blocking I/O

Todd: /* Non-Blocking I/O */

2026-02-25T16:11:40Z

Non-Blocking I/O

Todd: Todd moved page Module5-Test to Module5-NodeJS-TEST

2026-02-24T14:26:40Z

Todd moved page Module5-Test to Module5-NodeJS-TEST

Todd at 14:16, 24 February 2026

2026-02-24T14:16:54Z

Todd: Created page with "Node.js is a JavaScript runtime built on Chrome's V8 engine that allows JavaScript to run on the server. It is not a framework. Frameworks such as Express run on top of Node..."

2026-02-24T14:16:32Z

Created page with "Node.js is a JavaScript runtime built on Chrome's V8 engine that allows JavaScript to run on the server. It is not a framework. Frameworks such as Express run on top of Node..."

New page

Node.js is a JavaScript runtime built on Chrome's V8 engine that allows JavaScript to run on the server. It is not a framework. Frameworks such as Express run on top of Node.js.

Node.js is especially useful for real-time, high-concurrency applications due to its non-blocking, event-driven execution model.

== Non-Blocking I/O ==

Node.js uses a non-blocking execution model. Instead of waiting for operations (like database queries or file reads) to complete, Node continues executing other work and runs a callback or Promise when the operation finishes.

Blocking example (conceptual):

<source lang="javascript">
var data = database.query("select * from news");
print(data[0].title);
</source>

Non-blocking example:

<source lang="javascript">
database.query("select * from news", function(data){
print(data[0].title);
});
</source>

Modern Node.js commonly uses '''async/await''' instead of callbacks:

<source lang="javascript">
const data = await database.query("select * from news");
console.log(data[0].title);
</source>

== Installing Node.js ==

We use '''nvm (Node Version Manager)''' to install Node:

<source lang="bash">
$ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
$ source ~/.bashrc
$ nvm install --lts
$ node -v
$ npm -v
</source>

== Your First Node.js Application ==

Create a file named '''hello.js''':

<source lang="javascript">
import http from "node:http";

http.createServer((req, res) => {
res.writeHead(200, { "Content-Type": "text/plain" });
res.end("Hello World\n");
}).listen(3456);

console.log("Server running at http://localhost:3456/");
</source>

Run:

<source lang="bash">
$ node hello.js
</source>

'''Important:''' Modern Node uses ES Modules. Add this to package.json:

<source lang="json">
{
"type": "module"
}
</source>

== Installing Packages with npm ==

Install dependencies locally:

<source lang="bash">
$ npm install mime
</source>

npm automatically records dependencies in '''package.json'''.

== Static File Server ==

The following server serves static files from a directory:

<source lang="javascript">
import http from "node:http";
import { readFile } from "node:fs/promises";
import { existsSync } from "node:fs";
import path from "node:path";
import mime from "mime";
import { fileURLToPath } from "node:url";

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

const STATIC_DIR = "<STATIC DIRECTORY NAME>";

const app = http.createServer(async (req, resp) => {
try {
const urlPath = new URL(req.url, "http://localhost").pathname;
const filename = path.join(__dirname, STATIC_DIR, decodeURIComponent(urlPath));

if (!existsSync(filename)) {
resp.writeHead(404, { "Content-Type": "text/plain" });
resp.end("File not found");
return;
}

const data = await readFile(filename);
const mimetype = mime.getType(filename) || "application/octet-stream";

resp.writeHead(200, { "Content-Type": mimetype });
resp.end(data);
} catch {
resp.writeHead(500);
resp.end("Server error");
}
});

app.listen(3456);
</source>

'''Security Note:''' Production servers must validate file paths to prevent directory traversal attacks.

== Opening Port 3456 on EC2 ==

Follow the same process used previously to open port 80, but create a rule for TCP port 3456.

== Node.js Security ==

Common risks include:

* XSS
* CSRF
* Injection attacks
* Unsafe use of eval()
* Directory traversal

Always validate inputs and sanitize outputs.

== Node.js Conventions ==

Initialize a project:

<source lang="bash">
$ npm init -y
</source>

Install dependencies:

<source lang="bash">
$ npm install
</source>

package.json stores metadata and dependencies.

[[Category:Module 7]]

← Older revision		Revision as of 16:26, 25 February 2026
Line 308:		Line 308:

	http://your-ec2-ip:3456/		http://your-ec2-ip:3456/
		+
		+	== Node.js Security ==
		+
		+	Just because we're writing in JavaScript does not mean we can ignore the security principles you've been learning throughout CSE 330.
		+
		+	Node.js applications are still vulnerable to:
		+
		+	* Cross-Site Scripting (XSS)
		+	* Cross-Site Request Forgery (CSRF)
		+	* Injection attacks
		+	* Directory traversal
		+	* Insecure use of <code>eval()</code>
		+	* Improper input validation
		+
		+	Node does not automatically protect you from these issues. The fact that you are running JavaScript on the server instead of PHP does not change the underlying security model of the web.
		+
		+	For example:
		+
		+	* If you echo unsanitized user input into HTML, you still create an XSS vulnerability.
		+	* If you trust query parameters without validation, you still risk injection attacks.
		+	* If your static server does not validate paths properly, you risk directory traversal attacks (e.g., requests containing <code>../</code>).
		+
		+	Modern Node frameworks (like Express) provide tools that can help mitigate certain risks, but they do not eliminate the need for careful programming.
		+
		+	Security remains the responsibility of the developer.

← Older revision		Revision as of 16:15, 25 February 2026
Line 58:		Line 58:

	Understanding the callback model helps you understand how Node works internally. Understanding async/await helps you write modern, readable Node applications.		Understanding the callback model helps you understand how Node works internally. Understanding async/await helps you write modern, readable Node applications.
−
−
−	~~STOP~~
−
−	The revised pseudo-code achieves the same end result as the first version. However, it allows other clients to perform tasks while this process is waiting for the database to be queried! The code occurs in two parts: first, we start the query. Second, when the query is complete, our anonymous callback function is executed. In Node.js, callback functions are usually passed one or more parameters.
−
−	~~Better yet, with non-blocking I/O, you have no concurrency issues, because everything runs in just one thread. Nifty!~~
−
−	~~Modern Node.js commonly uses '''async/await''' instead of callbacks:~~
−
−	~~<source lang="javascript">~~
−	~~const data = await database.query("select * from news");~~
−	~~console.log(data[0].title);~~
−	~~</source>~~

	== Installing Node.js ==		== Installing Node.js ==

@@ Line 25: / Line 25: @@
 });
 </source>
 The revised pseudo-code achieves the same end result as the first version. However, it allows other clients to perform tasks while this process is waiting for the database to be queried! The code occurs in two parts: first, we start the query. Second, when the query is complete, our anonymous callback function is executed. In Node.js, callback functions are usually passed one or more parameters.

← Older revision		Revision as of 14:16, 24 February 2026
Line 1:		Line 1:
−	Node.js is a JavaScript runtime built on Chrome's V8 engine that allows JavaScript to run on the server. ~~It is not a framework.~~ Frameworks such as Express run on top of Node.js.	+	Node.js is a JavaScript runtime built on Chrome's V8 engine that allows JavaScript to run on the server. Frameworks such as Express run on top of Node.js.

	Node.js is especially useful for real-time, high-concurrency applications due to its non-blocking, event-driven execution model.		Node.js is especially useful for real-time, high-concurrency applications due to its non-blocking, event-driven execution model.

@@ Line 85: / Line 85: @@
 console.log("Server running at http://localhost:3456/");
 </source>
 Run:

@@ Line 13: / Line 13: @@
 print(data[0].title);
 </source>
 Non-blocking example:
@@ Line 21: / Line 25: @@
 });
 </source>
 Modern Node.js commonly uses '''async/await''' instead of callbacks:

← Older revision	Revision as of 14:26, 24 February 2026
(No difference)