book

Node.js

Name: Node.js
ISBN: 9781806108435

by Rheinwerk Publishing, Inc, Sebastian Springer

June 2025

Intermediate to advanced

837 pages

24h 50m

English

Packt Publishing

Read now

Unlock full access

Dear Reader
Notes on Usage
Table of Contents
Preface
Structure of the Book Downloading the Code Samples Acknowledgments
1 Basic Principles
1.1 The Story of Node.js1.1.1 Origins1.1.2 Birth of Node.js1.1.3 Breakthrough of Node.js1.1.4 Node.js Conquers Windows1.1.5 io.js: The Fork of Node.js1.1.6 Node.js Reunited1.1.7 Deno: A New Star in the JavaScript Sky1.1.8 OpenJS Foundation
1.2 Organization of Node.js
1.2.1 Technical Steering Committee1.2.2 Collaborators1.2.3 Community Committee1.2.4 Work Groups1.2.5 OpenJS Foundation
1.3 Versioning of Node.js
1.3.1 Long-Term Support Releases
1.4 Benefits of Node.js
1.5 Areas of Use for Node.js
1.6 The Core: V8 Engine
1.6.1 Memory Model1.6.2 Accessing Properties1.6.3 Machine Code Generation1.6.4 Garbage Collection

1.7 Libraries around the Engine
1.7.1 Event Loop1.7.2 Input and Output1.7.3 libuv1.7.4 Domain Name System1.7.5 Crypto1.7.6 Zlib1.7.7 HTTP Parser
1.8 Summary
2 Installation
2.1 Installing Packages2.1.1 Linux2.1.2 Windows2.1.3 macOS
2.2 Compiling and Installing
2.3 Node Version Manager
2.4 Node and Docker
2.5 Summary
3 Developing Your First Application
3.1 Interactive Mode3.1.1 General Use3.1.2 Other REPL Commands3.1.3 Saving and Loading in the REPL3.1.4 Context of the REPL3.1.5 REPL History3.1.6 REPL Mode3.1.7 Searching in the REPL3.1.8 Asynchronous Operations in the REPL
3.2 The First Application
3.2.1 Web Server in Node.js3.2.2 Extending the Web Server3.2.3 Creating an HTML Response3.2.4 Generating Dynamic Responses
3.3 Debugging Node.js Applications
3.3.1 Navigating in the Debugger3.3.2 Information in the Debugger3.3.3 Breakpoints3.3.4 Debugging with Chrome Developer Tools3.3.5 Debugging in the Development Environment
3.4 nodemon Development Tool
3.5 Summary
4 Node.js Modules
4.1 Modular Structure
4.2 Core Modules
4.2.1 Stability4.2.2 List of Core Modules4.2.3 Loading Core Modules4.2.4 Global Objects
4.3 JavaScript Module Systems
4.3.1 CommonJS4.3.2 ECMAScript Modules
4.4 Creating and Using Your Own Modules
4.4.1 Modules in Node.js: CommonJS4.4.2 Custom Node.js Modules4.4.3 Modules in Node.js: ECMAScript4.4.4 Exporting Different Types of Data4.4.5 The modules Module4.4.6 Module Loader
4.5 Summary
5 HTTP
5.1 Web Server5.1.1 Server Object5.1.2 Server Events5.1.3 Request Object5.1.4 Handling the Request Body (Update)5.1.5 Delivering Static Content5.1.6 File Upload5.1.7 Fine-Tuning the Frontend
5.2 Node.js as HTTP Client
5.2.1 Requests with the http Module5.2.2 The request Package5.2.3 HTML Parser
5.3 Secure Communication with HTTPS
5.3.1 Creating Certificates5.3.2 Using HTTPS in the Web Server
5.4 HTTP/2
5.4.1 HTTP/2 Server5.4.2 HTTP/2 Client
5.5 Summary
6 Express
6.1 Structure
6.2 Installation
6.3 Basic Principles
6.3.1 Request6.3.2 Response
6.4 Setup
6.4.1 Structure of an Application
6.5 Movie Database
6.5.1 Routing6.5.2 Controller6.5.3 Model6.5.4 View
6.6 Middleware
6.6.1 Custom Middleware6.6.2 Morgan: Logging Middleware for Express6.6.3 Delivering Static Content
6.7 Extended Routing: Deleting Data Records
6.8 Creating and Editing Data Records: Body Parser
6.8.1 Handling Form Input: Body Parser
6.9 Express 5
6.10 HTTPS and HTTP/2
6.10.1 HTTPS6.10.2 HTTP/2
6.11 Summary
7 Template Engines
7.1 Custom Template Engine
7.2 Template Engines in Practice: Pug
7.2.1 Installation7.2.2 Pug and Express: Integration7.2.3 Variables in Pug7.2.4 Specific Features of Pug7.2.5 Conditions and Loops7.2.6 Extends and Includes7.2.7 Mixins7.2.8 Using Pug without Express7.2.9 Compiling
7.3 Handlebars
7.3.1 Installation7.3.2 Integration with Express7.3.3 Conditions and Loops7.3.4 Partials7.3.5 Custom Helpers7.3.6 Handlebars without Express
7.4 Summary
8 Connecting Databases
8.1 Node.js and Relational Databases8.1.1 MySQL8.1.2 SQLite8.1.3 Object-Relational Mapping
8.2 Node.js and Nonrelational Databases
8.2.1 Redis8.2.2 MongoDB
8.3 Summary
9 Authentication and Session Handling
9.1 Passport
9.2 Setup and Configuration
9.2.1 Installation9.2.2 Configuration9.2.3 Strategy Configuration
9.3 Logging In to the Application
9.3.1 Login Form9.3.2 Securing Resources9.3.3 Logging Out9.3.4 Connecting to the Database
9.4 Accessing Resources
9.4.1 Access Restriction9.4.2 Submitting Ratings
9.5 Summary
10 REST Server
10.1 Introduction to REST and Usage in Web Applications
10.2 Accessing the Application
10.2.1 Postman10.2.2 cURL
10.3 Adaptations to the Application Structure
10.4 Read Requests
10.4.1 Reading All Data Records of a Resource10.4.2 Accessing a Data Record10.4.3 Error Handling10.4.4 Sorting the List10.4.5 Controlling the Output Format
10.5 Write Requests
10.5.1 POST: Creating New Data Records10.5.2 PUT: Modifying Existing Data Records10.5.3 DELETE: Deleting Data Records
10.6 Authentication via JWTs
10.6.1 Login10.6.2 Safeguarding Resources10.6.3 Accessing User Information in the Token
10.7 OpenAPI Specification: Documentation with Swagger
10.8 Validation
10.8.1 Installation and First Validation10.8.2 Checking Requests with a Validation Schema
10.9 Summary
11 GraphQL
11.1 GraphQL Libraries
11.2 Integration with Express
11.3 GraphiQL
11.4 Reading Data via the Interface
11.4.1 Parameterizing Queries
11.5 Write Accesses to the GraphQL Interface
11.5.1 Creating New Data Records11.5.2 Updating and Deleting Data Records
11.6 Authentication for the GraphQL Interface
11.7 Summary
12 Real-Time Web Applications
12.1 The Sample Application
12.2 Setup
12.3 WebSockets
12.3.1 The Server Side12.3.2 The Client Side12.3.3 User List12.3.4 Logout
12.4 Socket.IO
12.4.1 Installation and Integration12.4.2 Socket.IO API
12.5 Summary
13 Type-Safe Applications in Node.js
13.1 Type Systems for Node.js13.1.1 Flow13.1.2 TypeScript
13.2 Tools and Configuration
13.2.1 Configuring the TypeScript Compiler13.2.2 Integration into the Development Environment13.2.3 ESLint13.2.4 ts-node
13.3 Basic Principles
13.3.1 Data Types13.3.2 Functions13.3.3 Modules
13.4 Classes
13.4.1 Methods13.4.2 Access Modifiers13.4.3 Inheritance
13.5 Interfaces
13.6 Type Aliases in TypeScript
13.7 Generics
13.8 TypeScript in Use in a Node.js Application
13.8.1 Type Definitions13.8.2 Creating Custom Type Definitions13.8.3 Sample Express Application
13.9 Summary
14 Web Applications with Nest
14.1 Installation and Getting Started with Nest
14.2 Nest Command-Line Interface
14.2.1 Commands for Operating and Running the Application14.2.2 Creating Structures in the Application
14.3 Structure of the Application
14.3.1 Root Directory with the Configuration Files14.3.2 src Directory: Core of the Application14.3.3 Other Directories of the Application
14.4 Modules: Logical Units in the Source Code
14.4.1 Creating Modules14.4.2 Module Decorator
14.5 Controllers: Endpoints of an Application
14.5.1 Creating a Controller14.5.2 Implementing a Controller14.5.3 Integrating and Checking the Controller
14.6 Providers: Business Logic of the Application
14.6.1 Creating and Including a Service14.6.2 Implementing the Service14.6.3 Integrating the Service via Nest’s Dependency Injection
14.7 Accessing Databases
14.7.1 Setup and Installation14.7.2 Accessing the Database
14.8 Documenting the Endpoints with OpenAPI
14.9 Authentication
14.9.1 Setup14.9.2 Authentication Service14.9.3 Login Controller: Endpoint for User Login14.9.4 Protecting Routes
14.10 Outlook: Testing in Nest
14.11 Summary
15 Node on the Command Line
15.1 Basic Principles15.1.1 Structure15.1.2 Executability
15.2 Structure of a Command-Line Application
15.2.1 File and Directory Structure15.2.2 Package Definition15.2.3 Math Trainer Application
15.3 Accessing Input and Output
15.3.1 Output15.3.2 Input15.3.3 User Interaction with the readline Module15.3.4 Options and Arguments
15.4 Tools
15.4.1 Commander15.4.2 Chalk15.4.3 node-emoji
15.5 Signals
15.6 Exit Codes
15.7 Summary
16 Asynchronous Programming
16.1 Basic Principles of Asynchronous Programming16.1.1 The child_process Module
16.2 Running External Commands Asynchronously
16.2.1 The exec Method16.2.2 The spawn Method
16.3 Creating Node.js Child Processes with fork Method
16.4 The cluster Module
16.4.1 Main Process16.4.2 Worker Processes
16.5 Worker Threads
16.5.1 Shared Memory in the worker_threads Module
16.6 Promises in Node.js
16.6.1 Using util.promisify to Use Promises Where None Actually Exist16.6.2 Concatenating Promises16.6.3 Multiple Parallel Operations with Promise.all16.6.4 Fastest Asynchronous Operation with Promise.race16.6.5 Overview of the Promise Functions
16.7 Async Functions
16.7.1 Top-Level Await
16.8 Summary
17 RxJS
17.1 Basic Principles17.1.1 Installation and Integration17.1.2 Observable17.1.3 Observer17.1.4 Operator17.1.5 Example of RxJS in Node.js
17.2 Operators
17.2.1 Creation Operators17.2.2 Transformation Operators17.2.3 Filtering Operators17.2.4 Join Operators17.2.5 Error Handling Operators17.2.6 Utility Operators17.2.7 Conditional Operators17.2.8 Connection Operators17.2.9 Conversion Operators
17.3 Subjects
17.4 Schedulers
17.5 Summary
18 Streams
18.1 Introduction18.1.1 What Is a Stream?18.1.2 Stream Usages18.1.3 Available Streams18.1.4 Stream Versions in Node.js18.1.5 Streams Are EventEmitters
18.2 Readable Streams
18.2.1 Creating a Readable Stream18.2.2 Readable Stream Interface18.2.3 Events of a Readable Stream18.2.4 Error Handling in Readable Streams18.2.5 Methods18.2.6 Piping18.2.7 Readable Stream Modes18.2.8 Switching to Flowing Mode18.2.9 Switching to the Paused Mode18.2.10 Custom Readable Streams18.2.11 Example of a Readable Stream18.2.12 Readable Shortcut
18.3 Writable Streams
18.3.1 Creating a Writable Stream18.3.2 Events18.3.3 Error Handling in Writable Streams18.3.4 Methods18.3.5 Buffering Write Operations18.3.6 Flow Control18.3.7 Custom Writable Streams18.3.8 Writable Shortcut
18.4 Duplex Streams
18.4.1 Duplex Streams in Use18.4.2 Custom Duplex Streams18.4.3 Duplex Shortcut
18.5 Transform Streams
18.5.1 Custom Transform Streams18.5.2 Transform Shortcut
18.6 Gulp
18.6.1 Installation18.6.2 Example of a Build Process with Gulp
18.7 Summary
19 Working with Files
19.1 Synchronous and Asynchronous Functions
19.2 Existence of Files
19.3 Reading Files
19.3.1 Promise-Based API
19.4 Error Handling
19.5 Writing to Files
19.6 Directory Operations
19.7 Advanced Operations
19.7.1 The watch Method19.7.2 Access Permissions
19.8 Summary
20 Socket Server
20.1 Unix Sockets20.1.1 Accessing the Socket20.1.2 Bidirectional Communication
20.2 Windows Pipes
20.3 TCP Sockets
20.3.1 Data Transfer20.3.2 File Transfer20.3.3 Flow Control20.3.4 Duplex20.3.5 Pipe
20.4 UDP Sockets
20.4.1 Basic Principles of a UDP Server20.4.2 Example Illustrating the UDP Server
20.5 Summary
21 Package Manager
21.1 Most Common Operations21.1.1 Searching Packages21.1.2 Installing Packages21.1.3 Viewing Installed Packages21.1.4 Using Packages21.1.5 Updating Packages21.1.6 Removing Packages21.1.7 Overview of the Most Important Commands
21.2 Advanced Operations
21.2.1 Structure of a Module21.2.2 Creating Custom Packages21.2.3 Node Package Manager Scripts
21.3 Tools for Node Package Manager
21.3.1 Node License Finder21.3.2 Verdaccio21.3.3 npm-check-updates21.3.4 npx
21.4 Yarn
21.5 Summary
22 Quality Assurance
22.1 Style Guides22.1.1 Airbnb Style Guide
22.2 Linter
22.2.1 ESLint
22.3 Prettier
22.3.1 Installation22.3.2 Execution
22.4 Programming Mistake Detector: Copy/Paste Detector
22.4.1 Installation22.4.2 Execution
22.5 Husky
22.6 Summary
23 Testing
23.1 Unit Testing23.1.1 Directory Structure23.1.2 Unit Tests and Node.js23.1.3 Arrange, Act, Assert
23.2 Assertion Testing
23.2.1 Exceptions23.2.2 Testing Promises
23.3 Jasmine
23.3.1 Installation23.3.2 Configuration23.3.3 Tests in Jasmine23.3.4 Assertions23.3.5 Spies23.3.6 beforeEach and afterEach
23.4 Jest
23.4.1 Installation23.4.2 First Test
23.5 Practical Example of Unit Tests with Jest
23.5.1 The Test23.5.2 Implementation23.5.3 Triangulation: Second Test23.5.4 Optimizing the Implementation
23.6 Dealing with Dependencies: Mocking
23.7 Summary
24 Security
24.1 Filter Input and Escape Output24.1.1 Filter Input24.1.2 Blacklisting and Whitelisting24.1.3 Escape Output
24.2 Protecting the Server
24.2.1 User Permissions24.2.2 Problems Caused by the Single-Threaded Approach24.2.3 Denial-of-Service Attacks24.2.4 Regular Expressions24.2.5 HTTP Header24.2.6 Error Messages24.2.7 SQL Injections24.2.8 eval24.2.9 Method Invocation24.2.10 Overwriting Built-Ins
24.3 Node Package Manager Security
24.3.1 Permissions24.3.2 Node Security Platform24.3.3 Quality Aspect24.3.4 Node Package Manager Scripts
24.4 Client Protection
24.4.1 Cross-Site Scripting24.4.2 Cross-Site Request Forgery
24.5 Summary
25 Scalability and Deployment
25.1 Deployment25.1.1 Simple Deployment25.1.2 File Synchronization via rsync25.1.3 Application as a Service25.1.4 node_modules in Deployment25.1.5 Installing Applications Using Node Package Manager25.1.6 Installing Packages Locally
25.2 Tool Support
25.2.1 Grunt25.2.2 Gulp25.2.3 Node Package Manager
25.3 Scaling
25.3.1 Child Processes25.3.2 Load Balancer25.3.3 Node in the Cloud
25.4 pm2: Process Management
25.5 Docker
25.5.1 Dockerfile25.5.2 Starting the Container
25.6 Summary
26 Performance
26.1 You Aren’t Gonna Need It
26.2 CPU
26.2.1 CPU-Blocking Operations26.2.2 Measuring the CPU Load26.2.3 CPU Profiling with Chrome DevTools26.2.4 Alternatives to the Profiler: console.time26.2.5 Alternatives to the Profiler: Performance-Hooks Interface
26.3 Memory
26.3.1 Memory Leaks26.3.2 Memory Analysis in DevTools26.3.3 Node.js Memory Statistics
26.4 Network
26.5 Summary
27 Microservices with Node.js
27.1 Basic Principles27.1.1 Monolithic Architecture27.1.2 Microservice Architecture
27.2 Architecture
27.2.1 Communication between Individual Services
27.3 Infrastructure
27.3.1 Docker Compose
27.4 Asynchronous Microservice with RabbitMQ
27.4.1 Installation and Setup27.4.2 Connecting to the RabbitMQ Server27.4.3 Handling Incoming Messages27.4.4 Database Connection27.4.5 Docker Setup
27.5 API Gateway
27.5.1 Connecting the User Service27.5.2 Asynchronous Communication with the User Service27.5.3 Docker Setup of the API Gateway27.5.4 Authentication
27.6 Synchronous Microservice with Express
27.6.1 Setup27.6.2 Controller27.6.3 Model Implementation27.6.4 Docker Setup27.6.5 Integration into the API Gateway
27.7 Summary
28 Deno
28.1 The Ten Things Ryan Dahl Regrets about Node.js28.1.1 Promises28.1.2 Security28.1.3 The Generate Your Projects Build System28.1.4 Package.json28.1.5 Node_modules28.1.6 Optional File Extension When Loading Modules28.1.7 Index.js28.1.8 What’s Going on Now with Node.js
28.2 Installing Deno
28.2.1 Deno Command-Line Interface
28.3 Execution
28.3.1 Running a TypeScript Application
28.4 Handling Files
28.4.1 The Task: Copying a File28.4.2 Processing Command-Line Options28.4.3 Reading Files28.4.4 Permissions in Deno28.4.5 readTextFile Function28.4.6 Writing Files with Deno
28.5 Web Server with Deno
28.6 Module System
28.6.1 Loading External Modules into Deno28.6.2 deno.land/x28.6.3 Using Node Package Manager Packages
28.7 Summary
The Author
Index
Service Pages
Legal Notes

Content preview from Node.js

24.3 Node Package Manager Security

As previously mentioned, npm poses a security risk that shouldn’t be underestimated. To demonstrate this, there was a package called rimrafall in the npm repository some time ago. This package served no other purpose than to run rm -rf /* /.* on a machine and thus delete all files. The following sections describe in detail how this works. However, this action caused many people to now question the trustworthiness of npm packages before installing them.

24.3.1 Permissions

The npm is a very powerful tool, and for this very reason, you should be very careful when using it in conjunction with your computer’s administrator account. A sudo npm install paketX on a Unix system will cause the process to run as ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781806108435

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Node.js

by Rheinwerk Publishing, Inc, Sebastian Springer

24.3 Node Package Manager Security

24.3.1 Permissions

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Node.js for Beginners

Node.js Projects

Node.js: Novice to Ninja

Mastering Node.js Web Development

Publisher Resources