-
Notifications
You must be signed in to change notification settings - Fork 0
/
app.js
78 lines (64 loc) · 1.97 KB
/
app.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
require('dotenv').config()
var createError = require('http-errors')
var express = require('express')
var path = require('path')
var cookieParser = require('cookie-parser')
var logger = require('morgan')
//Import routes
var indexRouter = require('./routes/index')
var usersRouter = require('./routes/users')
const catalogRouter = require('./routes/catalog')
// Import Compress
const compression = require('compression')
const helmet = require('helmet')
var app = express()
// Set up rate limiter: maximum of twenty requests per minute
const RateLimit = require('express-rate-limit')
const limiter = RateLimit({
validate: { xForwardedForHeader: false },
windowMs: 1 * 60 * 1000, // 1 minute
max: 60,
})
// Apply rate limiter to all requests
app.use(limiter)
// Add helmet to the middleware chain.
// Set CSP headers to allow our Bootstrap to be served
app.use(
helmet.contentSecurityPolicy({
directives: {
'script-src': ["'self'", 'cdn.jsdelivr.net'],
},
})
)
// Mongoose
const mongoose = require('mongoose')
mongoose.set('strictQuery', false)
const mongoDB = process.env.MONGODB_URI
mongoose.connect(mongoDB).catch((error) => console.log(error))
// Compress all routes
app.use(compression())
// view engine setup
app.set('views', path.join(__dirname, 'views'))
app.set('view engine', 'ejs')
app.use(logger('dev'))
app.use(express.json())
app.use(express.urlencoded({ extended: false }))
app.use(cookieParser())
app.use(express.static(path.join(__dirname, 'public')))
app.use('/', indexRouter)
app.use('/users', usersRouter)
app.use('/catalog', catalogRouter)
// catch 404 and forward to error handler
app.use(function (req, res, next) {
next(createError(404))
})
// error handler
app.use(function (err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message
res.locals.error = req.app.get('env') === 'development' ? err : {}
// render the error page
res.status(err.status || 500)
res.render('error')
})
module.exports = app