@dooboostore/simple-boot-http-server

Full Documentation: https://dooboostore-develop.github.io/@dooboostore/simple-boot-http-server

A lightweight and powerful HTTP web server framework for Node.js, built on @dooboostore/simple-boot.

Features

• Declarative Routing: Use decorators like @Router, @Route, @GET, @POST, etc., to map URL paths and HTTP methods directly to your controller methods.
• Middleware via Filters: Intercept the request-response cycle with Filter classes to implement cross-cutting concerns like logging, authentication, and CORS.
• Lifecycle Endpoints: Hook into the request lifecycle with EndPoint classes that run on request start, close, or error.
• Integrated Exception Handling: Leverage @simple-boot's AOP capabilities to create robust global error handlers.
• Built-in Session Management: Easily manage user sessions with a built-in session manager and customizable storage.
• HTTPS and HTTP/2 Support: Secure your server with HTTPS and HTTP/2 configuration.
• WebSocket Topics + Events: Topic-based subscribe/request/response with server events.
• WebSocket Binary File Transfer: Send/receive files inside regular message payloads (JSON + binary framing).
• WebSocket Auto Reconnect: Automatic reconnect and re-subscribe with configurable retry.

Quick Start

npx @dooboostore/create-simple-boot-http-server my-server
cd my-server
npm start

Security Hardening

• Enforce TLS in production: configure HTTPS (or terminate TLS at a trusted reverse proxy) and redirect HTTP to HTTPS.
• Keep session cookies hardened: use httpOnly, secure, sameSite, short expiration, and explicit domain/path when required.
• Protect WebSocket endpoints: validate origin, authenticate at connect/subscribe time, and authorize per topic.
• Validate all inputs: apply strict validation for route params, query/body payloads, and uploaded files (type/size/path).
• Avoid sensitive data leakage: never return stack traces, internal file paths, raw SQL errors, or secrets in responses/logs.
• Configure CORS minimally: allow only required origins/methods/headers, avoid wildcard credentials.
• Add rate limiting and timeout guards: mitigate brute force and resource-exhaustion attacks.
• Rotate secrets/keys regularly and load them from environment or a secret manager (never hardcode in source).
• Keep dependencies updated and scan regularly for CVEs.

Minimal Production Checklist

• HTTPS enabled end-to-end
• Session cookie options set (httpOnly, secure, sameSite)
• CORS restricted to trusted origins
• Request/WS auth + authorization enforced
• Upload size/type limits configured
• Error responses sanitized

Learn More

The detailed API documentation, including all decorators and usage examples, is available on our documentation website.

• WebSocket Guide: document/websocket/README.md

License

This package is licensed under the MIT License.