Securing Static File Server with ExpressJS

Question

Securing Static File Server with ExpressJS

I've implemented an authentication system based on this tutorial using express.js and passport.js.

In the past I have used an express server with modRewrite that looked like this:

var express    = require('express');
var modRewrite = require('connect-modrewrite');

var app = express();
var baseURL = './dev/';
var portnum = 3000;

app.use(modRewrite([
  '^[^\\.]*$ /index.html [L]'
]))
.use(express.static(baseURL))
app.listen(process.env.PORT || portnum)

But now with the authentication in place I am using a route like so:

var baseURL = './dev/';

router.get('*', isAuthenticated, function(req, res, next){

    // if path contains file extension
    // behave as static file server
    if (req.path.indexOf('.') !== -1) {

        var fullPath = baseURL + req.path;
        res.sendfile(fullPath)

    // else send index.html
    } else {

        res.sendfile(baseURL + '/index.html')

    }

});

I am thinking there is a better way to do what I am trying to do, and I would like to take advantage of the express.static server as well as modRewrite. Also, my server with authentication is much slower, probably because it has to check the authentication each time a file is requested. Any tips on how to make this faster?

javascript
node.js
express

Answer 1

I use middleware to check whether the user is authenticated (whether that be in a JWT token or any number of other authentication schemes).

app.use(function (req, res, next) {
    if(isAuthenticated()) {
       next();
    } else {
       res.send(401, 'unauthorized');
    }
});