livibetter

This Gist has been moved to https://github.com/lbgists/gh-trend.py.

cerebrl

tl;dr

1. Don't run as root.
2. For sessions, set httpOnly (and secure to true if running over SSL) when setting cookies.
3. Use the Helmet for secure headers: https://github.com/evilpacket/helmet
4. Enable csrf for preventing Cross-Site Request Forgery: http://expressjs.com/api.html#csrf
5. Don't use the deprecated bodyParser() and only use multipart explicitly. To avoid multiparts vulnerability to 'temp file' bloat, use the defer property and pipe() the multipart upload stream to the intended destination.

cerebrl

var express = require('express');
var https = require('https');
var http = require('http');
var fs = require('fs');

// This line is from the Node.js HTTPS documentation.
var options = {
  key: fs.readFileSync('test/fixtures/keys/agent2-key.pem'),
  cert: fs.readFileSync('test/fixtures/keys/agent2-cert.pem')
};

jasonrudolph

5 entertaining things you can find with the GitHub Search API

Let's have some command-line fun with curl, [jq][1], and the [new GitHub Search API][2].

Today we're looking for:

• The hottest repositories created in the last week.
• The oldest user accounts with zero followers. (So sad.)
• Issue trends by language.
• Clojure projects defying convention.

mastergenius

Backend Development

• node.js
  • Installation paths: use one of these techniques to install node and npm without having to sudo.
  • Node.js HOWTO: Install Node+NPM as user (not root) under Unix OSes
  • Felix's Node.js Guide
  • Creating a REST API using Node.js, Express, and MongoDB
  • Node Cellar Sample Application with Backbone.js, Twitter Bootstrap, Node.js, Express, and MongoDB
  • JavaScript Event Loop
• Node.js for PHP programmers

paulirish

I wrote this in early January 2012, but never finished it. The research and thinking in this area led to a lot of the design of Yeoman and talks like "Javascript Development Workflow of 2013", "Web Application Development Workflow" and "App development stack for JS developers" (surpisingly little overlap in those talks, btw).

Now it's June 2013 and the state of web app tooling has matured quite a bit. But here's a snapshot of the story from 18 months ago, even if a little ugly and incomplete. :p

---

In the beginning…

• Intro to tooling

sansmischevia

##
##  This nginx.conf servers as the main config file for webflow reverse proxy
##
##  RCS:
##  https://gist.github.com/sansmischevia/5617402
##  
##  Hardening tips:
##  http://www.cyberciti.biz/tips/linux-unix-bsd-nginx-webserver-security.html
##  

benvium

<?php
/**
* Reads the requested portion of a file and sends its contents to the client with the appropriate headers.
* 
* This HTTP_RANGE compatible read file function is necessary for allowing streaming media to be skipped around in.
* 
* @param string $location
* @param string $filename
* @param string $mimeType
* @return void

xeoncross

<?php

require('relations.php');

$database = 'relations';

header('Content-Type: text/plain; charset="UTF-8"');

$relations = relations($database);

schakko

// Doing AES-256-CBC (salted) decryption with node.js. 
// This code is based on http://php.net/manual/de/function.openssl-decrypt.php and works with PHP sqAES.
//
// Create your encrypted data with 
// 		echo -n 'Hello world' | openssl aes-256-cbc -a -e 
var crypto = require('crypto');

var password = 'password';
var edata = 'U2FsdGVkX18M7K+pELP06c4d5gz7kLM1CcqJBbubW/Q=';