Arnout Kazemier 3rd-Eden

Auto rifles (2/4)

Scout Rifles (1/1)

MIDA Multi-Tool

BigPipe and React
React components
Share state
Server Side rendering
Modularization of components
Re-initialization
- checksum
- event adding
- html bloat
JSX

[Google recently announced][poodle] that there is an exploit in SSLv3, this vulnerability is know as POODLE. There is no other option than to disable SSLv3 in order to combat this major flaw. There have already been [guides on how to disable this in different servers][guides]. But nothing excised for Node.js yet, until now. In order to resolve this for Node.js we need to use various of undocumented options and modules.

In the index.js file below you can see an example of how you can protect your HTTPS server against the POODLE attack. It uses the secureOptions option to pass in constants in to the SSL context which is created by node.

	'use strict';

	var fs = require('fs')
	, path = require('path')
	, Primus = require('primus')
	, EventEmitter = require('events').EventEmitter
	, Socket = Primus.createSocket({ transformer: 'engine.io' });

	var server = require('http').createServer(function (req, res) {
	res.setHeader('Content-Type', 'text/html');

	'use strict';

	var React = require('react');
	React.Component.extend = require('extendible');

	var MyComponent = React.Component.extend({
	state: {
	what: 'extend'
	},
	render: function () {

	/ @jsx React.DOM /
	<div>
	<FormattedMessage
	message={getIntlMessage('post.meta')}
	num={props.post.comments.length}
	ago={<FormattedRelative value={props.post.date} />}
	/>
	<span>{random}</span>
	</div>

	0 info it worked if it ends with ok
	1 verbose cli [ 'node', '/Users/V1/.nvm/v0.10.35/bin/npm', 'install', '.' ]
	2 info using [email protected]
	3 info using [email protected]
	4 warn package.json [email protected] No README data
	5 verbose install where, deps [ '/Users/V1/Projects/websockets/utf-8-validate',
	5 verbose install [ 'bindings', 'nan' ] ]
	6 verbose install where, peers [ '/Users/V1/Projects/websockets/utf-8-validate', [] ]
	7 info preinstall [email protected]
	8 silly cache add args [ '[email protected]', null ]

	12:55:01 PM <omnidan> hi
	12:55:58 PM ⇐ therealkoopa quit ([email protected]) Ping timeout: 255 seconds
	12:56:07 PM <omnidan> is it possible to get the query in the authorization middleware without having a http server running? e.g. directly connecting from a nodejs primus client to a primus server
	12:56:29 PM <omnidan> also, is it possible to connect with a socket.io-client to primus with socket.io in the backend?
	1:06:03 PM → __quim_ and Kullt2 joined ⇐ __quim and Kullt quit ↔ therealkoopa popped in
	1:34:29 PM <_3rdEden> hi
	1:35:05 PM <_3rdEden> How would you get a request to your server when there isn't a server running omnidan ?
	1:35:51 PM <_3rdEden> omnidan: it should be possible to connect with a socket.io-client to a primus + socket.io backend
	1:36:00 PM <omnidan> _3rdEden: well there is a http server running, but I'm connecting via nodejs directly to primus, so it doesn't /use/ the server
	1:36:13 PM <omnidan> at least I think so, I'm not familiar with the inter

	var x = new Blob(['var loc = location; if (location.protocol === "blob:") loc = new URL(unescape(loc.pathname)); console.log(new URL("/foo", loc)); '], { type: 'text/javascript' })
	, y = URL.createObjectURL(x)
	, w = new Worker(y);